You know the sponsorship read. Your favorite YouTuber leans into the camera and explains that for somewhere between $16 and $46 a month, a service called Incogni will scrub your name, address, and phone number from the data brokers who trade in them. A recent video essay from the channel NeuroEverything pulled on that thread until a whole corporate family tree came out with it^[1]. I have spent time since checking its receipts. Most of them hold up, a couple needed correcting, and the picture they add up to is stranger, and a good deal more systemic, than the pitch.

Start with the mechanics, because they contain the first problem. Before Incogni can ask a broker to delete your file, you give Incogni your full name, date of birth, home address, and phone number, and Incogni sends that bundle to hundreds of brokers to ask whether they have you. If a broker already had your file, fine, the request might work. If it did not, it has one now: accurate, current, and attached to a person demonstrably willing to pay monthly for privacy. Outside California and a handful of registry states, no American law compels the broker to do anything with the request except keep it. And handing over raw personal data is not even technically necessary. The proof shows up later in this story, from the company you would least expect.

Incogni's terms say it does not sell your personal data, and there is no evidence it does. The same terms permit sharing within its family of companies. Which raises the only question that matters: who is the family?

The illusion of independence

Incogni launched in early 2022 as a product of Surfshark, the VPN company. For years Surfshark and Nord Security, maker of NordVPN, denied persistent claims that they were connected, then in February 2022 they merged^[2], becoming Lithuania's second unicorn at a $1.6 billion valuation, a figure that doubled to $3 billion in 2023 after a $100 million injection from the growth investor Warburg Pincus^[3]. Both companies trace back to Tesonet, a Vilnius holding company founded in 2008, whose portfolio also touches the hosting company Hostinger, the eSIM brand Saily, and a stack of other consumer internet services^[4]. It does not hurt that 'European tech' still carries an ethics halo in these conversations, or that a Baltic holding company draws far less scrutiny from the Western tech press than the same org chart would in Delaware.

The architecture of extraction

This family tree matters because Tesonet also operates the other side of the house. When scrapers want to harvest the web at industrial speed, ordinary datacenter IP addresses get blocked by anti-bot systems almost immediately, so the workaround is the residential proxy: routing the scraper's traffic through IP addresses belonging to ordinary homes and phones, which makes automated harvesting look like somebody's household browsing. Tesonet's Oxylabs advertises more than 175 million such residential IPs across 195 countries. Decodo, formerly Smartproxy, adds a claimed 125 million more, and Oxylabs acquired the budget provider Webshare on top^[5]. By the essay's math, companies under this one roof control somewhere around 40 to 50 percent of the world's proxy market^[1].

Collecting hundreds of millions of household IPs takes more than volunteers. The method the industry has historically leaned on is the covert SDK: a chunk of code embedded in free utility apps and mobile games that quietly turns the device into a proxy node and resells its bandwidth, and the person who installed the app, not the proxy firm, wears the risk when their home IP gets banned for whatever the scraper did with it^[1]. Oxylabs says it sources its network ethically, pointing to an exclusive partnership with Honeygain, an app where users volunteer their unused bandwidth for pocket change. The arithmetic has a hole in it: community estimates put Honeygain's entire network at roughly 10 million devices. That leaves Oxylabs' other 165 million household IPs unexplained. And the partnership itself has been traced, executive by executive, to being an arrangement between Oxylabs and itself, with personnel moving between identical roles at the two companies under the same Tesonet umbrella^[6].

Put the two halves of the portfolio next to each other and the business model reads plainly enough: one family of companies charges you a monthly fee to petition data brokers on your behalf, while operating a large share of the infrastructure the brokers' suppliers use to gather data at scale. Nothing about that is illegal. Everything about it is worth knowing before you type your birth date into the form.

A conflict of interest with a face on it

Tesonet's conflict is structural, spread across holding companies and corporate registries, which makes it easy to file away as an abstraction and move on. For the personal version, look at OneRep, another big removal brand, which sells privacy services to individuals, medical professionals, and police departments. A 2024 investigation by Brian Krebs found that OneRep's founder and CEO, Dimitri Shelest, had founded dozens of people-search sites, and domain records tied him to Nuwber, a broker OneRep charges to remove people from^[7]. Shelest admitted founding Nuwber in 2015, around the same time he launched OneRep, and defended the ongoing stake by arguing that insider knowledge of the people-search business is what makes OneRep's removal technology good. Mozilla, which had bundled OneRep into Firefox Monitor, announced it would walk away^[8], and still took until late 2025 to finish walking^[9].

And here is the proof I promised earlier, from the direction I did not expect. OneRep, of all companies, gets this part of the engineering right. It interacts with brokers through email aliases and virtual phone numbers, as do competitors like Optery, so the opt-out process never hands a broker a fresh, verified copy of your real details. The removal service with the compromised founder never leaks your identity to the brokers, while the one owned by a privacy conglomerate demands it up front. That answers the question from the mechanics: transmitting your real name, address, and birth date is a design choice, not a requirement. The people best positioned to sell you the antidote keep turning out to be the people who bottled the poison.

The regulators aren't coming

The essay's grimmest claim is about Europe, and it is the one that needed the most correcting, so let me do that in public. The claim was that EU regulators received 10,000 complaints and acted on seven. The reality is more bureaucratic. Under GDPR's one-stop-shop rule, a multinational answers to the regulator where it is headquartered, and because tech companies flock to Dublin for the tax treatment, the under-resourced Irish Data Protection Commission is the de facto lead regulator for most of Big Tech. Its 2020 annual report shows it handled 10,151 cases that year, received 4,660 formal GDPR complaints and concluded 4,476 of them, mostly through amicable resolution, and served punitive enforcement notices over cookies and tracking technologies on precisely seven organizations^[10]. So no, not seven actions out of ten thousand. Seven punitive actions, though, is the accurate number, complex cross-border cases have queued for years at a time, and I am not sure the corrected version is more comforting.

The United States does not need correcting because there is barely anything to correct. There is no federal removal right. A few states run broker registries, and Texas caps annual fines at ten thousand dollars, a number a data broker can lose in a couch cushion. A broker weighing that fine against opening its database to deletion mandates does not need a calculator. The EFF found hundreds of known brokers simply declining to register at all^[11]. This is the same regulatory vacuum that lets a sports arena run facial recognition against its owner's enemies list^[13]; the data market is what that vacuum looks like at wholesale.

What actually works

One genuinely new thing arrives next month. California's Delete Act requires the state's privacy agency to run DROP, the Delete Request and Opt-Out Platform, slated for August: a resident files one free request and every registered broker in the state, more than 600 of them, must delete their data within 45 days and not reacquire it^[12]. It covers Californians and registered brokers only, which is two asterisks wide enough to drive a scraper through, but it is the first removal mechanism in America with actual teeth, and it costs nothing.

For everyone else, the boring advice remains undefeated. Data you never hand out does not need removing: aliases and virtual numbers by default, real details only for people with a legal reason to have them. And hold a permanent, healthy skepticism toward anyone charging a monthly fee to erase you from the internet, because as far as I can tell, the only party in this whole economy guaranteed to end up with your data is the one you paid to make it disappear.

Proton 11.0-1 went stable on July 7, after a beta run that started in April^[1]. If you have only ever pressed the install button on a Steam Deck and had a Windows game simply work, Proton is the translation layer doing that work, and this release is the biggest thing to happen to it in a while. The change underneath is a rebase onto Wine 11.0, the upstream project Proton is built from^[2].

A rebase is the least glamorous word in software, which is a shame, because this one carries a year of freight. Wine 11.0 shipped in January with roughly 6,300 changes and over 600 bug fixes, including the completed 64-bit WoW64 architecture that lets ancient 32-bit and even 16-bit-era software run inside a single modern Wine installation^[3]. I covered the upstream side of this pipeline when Wine 11.12 came out^[5]; Proton 11 is where all of that finally reaches the version of Wine most people run without knowing they run it.

Now for the part where the coverage and the changelog disagree. The enthusiast press has mostly led with NTSync, Wine 11's headline feature, which moves Windows-style thread synchronization into a Linux kernel driver (kernel 6.14 or newer) instead of faking it in userspace^[4]. The famous numbers, Dirt 3 leaping from 110 to 860 frames per second, come from the original patch series, and they are pathological best cases. Most games are not pathological. Valve's own release notes, meanwhile, do not say the word NTSync once. When the people shipping a feature are quieter about it than the people covering it, trust the shipping manifest. Expect steadier frame pacing in heavily threaded games and no miracles anywhere else.

The retro wins

My favorite part of the release notes is the guest list. Newly playable or promoted out of Proton Experimental: Resident Evil from 1996, Resident Evil 2 from 1998, both Dino Crisis games, SHOGUN: Total War, Metal Fatigue, Gothic 1 Classic, Breath of Fire IV, and Deadly Premonition, alongside comparatively modern holdouts like X-Plane 12, DCS World, and Warhammer: Vermintide 2^[1]. A 2026 infrastructure release whose proudest conquests are a quarter century old reads like a punchline, and it is the opposite of one. Old Windows games are the genuinely hard ones. They assume long-dead DirectX behaviors, video memory measured in single-digit megabytes, and installers written for operating systems that no longer exist. The completed WoW64 work is a big part of why this pile of ancient software suddenly became tractable.

The fix people actually noticed

The line in the changelog that will rescue the most actual evenings is plainer: an EA Desktop update had left many EA games unplayable, and 11.0-1 fixes them, along with the Steam Overlay that had died across much of the EA catalog^[1]. Read that sequence back. The launcher broke the games, and the compatibility layer repaired them. EA shipped the breakage, Valve shipped the fix, and nobody involved seems to find that arrangement strange anymore. Elsewhere in the notes, Crimson Desert's intro video plays again, and controller hotplug support now covers devices like the 8BitDo Ultimate 2C.

Under the hood, the component stack moves to current DXVK and VKD3D-Proton snapshots, Wine Mono 11.0, and Xalia 0.4.9, and the notes list FEX 2605 for ARM64EC builds^[2]. That last item is the one to squint at. FEX translates x86 code for ARM processors, and Valve does not maintain an ARM build pipeline for fun. Nobody at Valve is saying what it is for, and they do not have to. Companies telegraph their hardware plans in changelogs long before they admit them on a stage, and this line keeps getting updated.

If you want it today, pick Proton 11.0 from the compatibility menu in any game's properties on Steam. Or do nothing: it is now the default stable release, and the entire point of the project is that most people never find out any of this happened. As pitches go, invisibility is a strange one, but it is the rare kind that undersells.

There is a small detail worth pointing out in this website's source code. Down in the assets folder sits a file called mastodon.js, and its entire job is to reach out to mastodon.social, pull the last few posts from an account named @casually, and render them on the page in our own styling^[1]. Wiring a brand-new site straight into the open social web took an afternoon and asked nobody's permission, which is the whole appeal of the ecosystem. So it is worth stepping back to lay out what it actually is in 2026, past both the hype and the obituaries.

The fediverse is an easy thing to be lazy about. For years the coverage has swung between two equally useless poles. It is either the plucky Twitter killer that will finally set us free, or it is a dead mailing list for people who enjoy arguing about software licenses. In 2026 it is neither, and the truth is more interesting than either sales pitch. The decentralized social web quietly turned into real infrastructure this year, with real institutional money and real standards work behind it, and it still cannot get a newcomer through the front door without losing a good number of them on the way in. Neither camp likes hearing it.

The numbers

Start with the count, because that is where the distortion lives. Across the whole fediverse there are now more than 12 million registered accounts, with somewhere around 2 million of them active in any given month^[2]. Mastodon, the largest single piece of it, holds roughly 10.5 million of those registered accounts as of spring 2026^[3]. So far, so healthy.

The reality check is how many of those accounts actually show up. The monthly-active figure sits somewhere between 750,000 and a million, and Mastodon's own dashboard puts it around 785,000^[4]. That gap, ten million registered against fewer than one million active, is the single most important number for understanding where the network really stands. It is not a scandal. Every social network on earth carries a registered-to-active chasm like it. But it is the number both camps conveniently skip: far too big for the 'it's dead' crowd, far too small for anyone selling it as the next Twitter.

For context, Mastodon's monthly active users peaked at about 2.6 million in November 2022, in the frantic weeks right after Elon Musk closed his Twitter deal^[2]. It has not come close since. Read that pessimistically and it is a platform that caught lightning once and could not hold it. Read it the other way and it is a platform that kept most of its infrastructure, its developers, and a stubborn core of users through three years of the hype cycle wandering off to the next thing. A million people who chose to stay is a very different asset from ten million who signed up during a news event and drifted away. Small and real beats big and rented.

What actually shipped

None of that would matter if the software had stalled, and the genuine surprise of 2026 is that it didn't. Mastodon 4.6 arrived in June with the kind of release notes that suggest someone finally sat down next to a new user and watched them struggle^[5]. The headline feature is Collections, curated lists of up to 25 accounts you can publish and share. It is the closest the network has come to the 'starter pack' idea that made finding people on other platforms bearable, and it includes opt-in controls so nobody can drop you onto a list without your say-so^[6]. Quote posts, long resisted on principle, finally shipped as well, with controls attached.

The rest of the update went to long-overdue quality of life. You can now crop an image or add alt text without being kicked out to a separate settings page. Non-users can follow public accounts by email. There is even an opt-in year-in-review.

The more important change is one most users will never see. Support for a proposal with the deeply unglamorous name FEP-3b86, or Activity Intents, merged into Mastodon back in March^[7]. What it does is let a server advertise the correct URLs for common actions (follow, reply, boost, like) so a button sitting on some other website can hand you off to your own home server to actually complete the action^[8]. If that sounds trivial, it is quietly aimed at the single most hated moment in the fediverse: clicking Follow on a stranger's post, being told to copy a URL, paste it into your own instance, and try again. The plumbing to kill that ritual now exists. Whether the apps bother to use it is the next question.

Mastodon is no longer the whole story, a reality the microblogging-obsessed coverage keeps missing. Ghost, the newsletter and blogging platform, now speaks ActivityPub natively, so a Ghost site can be followed directly from Mastodon and its posts land in the same timeline as everyone else's^[9]. That is a real publisher with real paying customers wiring itself into the open network on purpose^[10]. Loops, a short-video app from the people behind the Pixelfed photo network, joined the fediverse too, offering the one thing nobody expected to be open: a TikTok-shaped feed that federates^[11]. The interesting growth is happening sideways, into formats Twitter never owned in the first place.

Who is minding the standard

Here is the part that actually convinced me the grown-up framing is fair. In February, Mastodon GmbH joined the World Wide Web Consortium, the standards body that stewards the web, and sent people to the kickoff of a new Social Web Working Group whose job is to formally maintain ActivityPub, the protocol the entire fediverse runs on^[12]. A protocol that lives or dies on one company's goodwill is fragile. A protocol with a chartered W3C working group behind it is the boring kind of durable that outlasts any single app^[13]. This is the same idea, moved up to the level of a standard, that the whole pitch rests on: no single owner who can quietly revoke it.

The money is following the same logic. Germany's Sovereign Tech Fund, the state-backed program that pays to maintain critical open-source infrastructure, awarded Mastodon a service agreement worth 614,000 euros, and a chunk of it is earmarked for something the network has promised for years and never delivered: end-to-end encrypted direct messages^[14]. The plan is built on MLS over ActivityPub, with a feature called message franking so a recipient can still report an abusive message without the server ever being able to read it^[15]. The timeline is honest to the point of being unflattering. The work is slated to begin late in 2026 and land by the end of the second quarter of 2027, and even that is contingent on the W3C task force finishing a specification and two independent servers proving they can actually talk to each other. Real, but not soon. That is roughly the fediverse's entire personality compressed into one roadmap.

The problem at the front door

Which brings us back to the front door, because for all the standards work, what a normal person hits first is still a wall. In April, the site We Distribute graded the network against its own list of the 'Seven Deadly Fediverse UX Sins' and handed the whole ecosystem a C+^[16]. Some of that friction is genuinely lifting. Missing replies, where a conversation looked one-sided because your server had never fetched the other half of it, earned an A- once Mastodon 4.5 started backfilling them automatically. Instance-selection paralysis, that dreaded first screen where you are told to pick a server before you have any idea what a server is, is easing as newer apps like Loops simply pick a sensible default and let you change it later.

But the ugliest sin barely moved. Remote interaction, the copy-paste follow dance, scored a D-, because even though the infrastructure to fix it now exists, the actual web experience most people land on still shoves the raw URL at you and wishes you luck. Content discovery got a C: the ingredients are all there, as the report puts it, but nobody has baked the cake yet. The uncomfortable lesson underneath the grades is the one the movement doesn't like to say out loud. Decentralization is not free. Every bit of control it hands the user (which server, which rules, which algorithm) arrives as a decision the user never asked to make, at the exact moment they only wanted to read a post.

A centralized app makes all of those choices for you and calls the result simplicity. That is the trade, and no run of good release notes erases it.

So that is what is behind our little button. Not a revolution, and not a graveyard. A network of roughly a million active people that spent 2026 getting slowly, unglamorously more real: better releases, a seat at the standards table, public money aimed squarely at its biggest missing feature, and a sign-up page that still fumbles the handoff. The fediverse doesn't need anyone's permission, or anyone's coverage, to keep going, and that is exactly the point. It just keeps federating on a protocol nobody owns, one confusing onboarding screen at a time.

On the summit floor this year, a company called DeepComputing did something that reads like a stunt and is closer to a statement of intent. It took a Framework Laptop 13, swapped in a mainboard built entirely around an open, royalty-free chip, and ran a 7-billion-parameter DeepSeek model on it live^[1]. No cloud. No GPU. The board even had a dedicated AI accelerator sitting right there on the chip, but they ignored it. They ran the model on the general-purpose cores alone just to show they could. The speed was not going to worry a data center, but that was never the pitch. The pitch was that the chip owed nobody a license fee to exist.

The claim

The backdrop to that demo is a number the industry has been repeating all year: RISC-V, the open instruction set that started life as a Berkeley teaching project, has crossed 25 percent of the global market and earned a seat as the 'third pillar' of computing next to x86 and ARM^[2]. It's a great headline, but the 25 percent figure is doing a lot of quiet heavy lifting.

Start with who is saying it. The 25 percent figure comes from RISC-V International, the trade body that shepherds the standard, which announced the milestone as running ahead of schedule and backed it with research from the analyst firm SHD Group^[3]. That does not make it wrong, but it does mean the headline was produced by the organization whose entire job is to promote the thing. SHD's own forecast is more careful than the round number suggests, projecting RISC-V chip shipments growing at roughly 47 percent a year toward something like a third of the market and 16 billion units by 2030^[4]. The eye-catching share is measured in units, not dollars, and it is a trajectory as much as a snapshot.

Unit volume is the asterisk that matters most. The bulk of RISC-V's penetration is not laptops or servers. It is tiny embedded cores, many of them buried invisibly inside larger chips where they manage power delivery or shuffle basic I/O, the kind of silicon you already own without knowing it^[5]. Counting those is fair, but it means '25 percent of the market' describes a world where RISC-V is simultaneously everywhere and almost nowhere you can actually see. And by the time the figure had bounced through the content mill, it had curdled into fully automated press releases declaring 'the end of the proprietary duopoly,' bylined to an AI and citing no analyst at all^[6]. Look past the automated hype, and what is left is more modest, and more interesting, than the slop version of it.

Why open silicon matters

Strip away the market math and here is why anyone builds on RISC-V in the first place. An instruction set is the contract between software and the chip that runs it, and for decades that contract came from exactly two places. Intel and AMD own x86. ARM licenses its designs, collects a royalty on every core shipped, and gets a say in who is allowed to build what. RISC-V is a published standard anyone can implement without asking permission or paying a fee^[7]. That is the whole idea, and it is the same idea that made Linux matter: not that it is always better, but that no single company can revoke it, price you out of it, or fold it into a licensing fight you had no part in.

The technically neat part is that it is one family rather than a pile of unrelated chips. The same base design scales from a microcontroller too small to run an operating system up to laptop-class parts, with optional extensions, like the ratified RVV vector instructions for the math AI workloads lean on, layered on top only where they are needed^[8]. A vendor picks the pieces that fit and skips the rest, and code written against the standard extensions travels between them. For anyone who has watched a device get orphaned because its chip vendor lost interest, an architecture nobody can pull out from under you is not an abstraction. It is the difference between hardware you own and hardware you are renting.

The proof of life

That argument only means anything if the hardware actually exists, and this year it walked onstage. The board behind the demo is the DC-ROMA RISC-V Mainboard III^[9], a drop-in replacement for the guts of a Framework Laptop 13. It pairs up to 32 GB of memory with SpacemiT's K3, an eight-core, 2.5 GHz chip that happens to be the first RISC-V part to support the modern RVA23 software profile. That profile matters more than the clock speed. It is the agreement that lets a mainstream Linux distribution and its prebuilt binaries just run, instead of every board needing its own bespoke build. The K3 also carries an on-chip AI accelerator, and in other hands the same silicon has driven demos running 30-billion-parameter models at ten to fifteen tokens a second^[10].

This is precisely what makes the CPU-only run worth dwelling on. The K3's marketed AI muscle lives in that accelerator, not its general-purpose cores, so loading DeepSeek 7B onto the plain CPU was never the fast path, and nobody would put those numbers up against a laptop with a real GPU. That was the flex. The point was not speed, it was that a fully open, repairable laptop could load a modern language model and answer you with no network connection and no proprietary silicon anywhere in the loop, and still have its fast path in reserve. Two years ago that was a slide in a keynote. Now it is a board you can preorder.

The reality check

None of which means you should put your x86 machine on the curb. Desktop-class RISC-V in 2026 is still slow and still rough around the edges. The shipping Linux boards, the StarFive VisionFive 2, the Milk-V Mars, the Banana Pi BPI-F3, land closer to an entry-level ARM single-board computer than to a modern laptop. The fastest way to ruin a weekend is to buy a board whose vendor never got its kernel support merged upstream^[8]. Stick to the mainline-supported chips and the experience is genuinely usable. Wander off them and you inherit an out-of-tree kernel and a forum thread where the manual should be. The software still trails the silicon.

Where RISC-V is actually winning is the unglamorous part of the market the hype tends to skip: embedded controllers, IoT parts, and the long tail of chips where shaving a royalty off every unit is the entire business case^[11]. It is also winning where politics pushes it. China has thrown its weight behind the open standard precisely because it is not American-controlled and cannot be sanctioned away, and its state press now frames RISC-V as a route to semiconductor self-sufficiency^[12]. Read that as strategy rather than a hardware review, but it is strategy with real money and real fabs behind it, and it is a large part of why the shipment curve climbs as steeply as it does.

We have watched a smaller version of this before. When the ArmSoM Sige6 quietly ditched Rockchip for Allwinner, the interesting part was never the chip. It was the crack it opened in a one-vendor corner of the market. RISC-V is that same move at the scale of the whole industry: not a better chip so much as a refusal to let two companies own the ground everything else has to stand on. The 25 percent is softer than the headline, the desktop story is years from comfortable, and the FOSDEM and Summit Europe schedules are still thick with talks about toolchains that do not quite work yet^[13]. But the direction is not really in doubt. An architecture nobody can lock down doesn't have to be the fastest. It just has to be impossible to take away.

There is a kind of science headline built to trigger the lizard brain, and 'scientists want to quarantine alien life on the Moon' is close to the platonic ideal of it^[1]. The actual proposal underneath is quieter, and more interesting than the monster-movie framing suggests. In a peer-reviewed paper in the journal Ambio, two researchers argue that as we start hauling samples back from Mars, asteroids, and the icy moons, the safest place to open the containers first is not a lab on Earth but a robotic facility on the Moon^[2]. The claim is not that Martian germs are coming for us, but that we are far less sure than we pretend about what could survive the trip.

What they are actually proposing

The idea is a dedicated biocontainment facility on the lunar surface, handled entirely by machines, where returned material would be examined and stored before any of it comes near Earth's biosphere^[2]. Samples from Mars and other bodies would be routed there first, screened by robotic systems, and only cleared for the trip home once they were judged safe^[3]. The Moon, in this telling, becomes a kind of airlock for the solar system: close enough to reach, isolated enough to contain a mistake, and, as far as we can tell, carrying no biosphere of its own to contaminate in either direction^[4].

This is invasion biology, not a monster movie

The framing that makes the paper worth reading is who wrote it. One of the authors, Anthony Ricciardi, is an invasion biologist, someone who studies what happens when a species turns up somewhere its new neighbors never evolved to handle^[2]. Read through that lens, the argument stops being about little green men and starts sounding like every zebra mussel and cane toad case study you have ever heard, scaled up to a planet. The point is not that life on Mars is likely. It is that biologists keep finding extremophiles on Earth thriving in radioactive, frozen, or acidic places that should be lethal, which quietly undercuts the comfortable assumption that anything from Mars simply could not make it here^[1]. When the probability is low but genuinely unknown, and the downside is irreversible, ecologists tend to argue for caution. That is what this is.

We have done planetary quarantine before, badly

None of this is unprecedented, which is the part the coverage tends to skip. When Apollo brought the first Moon rocks and astronauts home, NASA ran them through a Lunar Receiving Laboratory built for exactly this fear, that something in the samples might be dangerous^[5]. By most later accounts the containment was closer to ritual than reality. NASA spent millions on sealed rooms and biological isolation suits, and then cracked the command module open in the middle of the Pacific, hatch to the open sky, with the ocean breeze rolling across the astronauts and every surface they had touched, hours before any of it reached a clean room. It worked out because the Moon turned out to be sterile, not because the procedure was sound. That history cuts both ways. It shows we have taken the risk seriously enough to plan for it, but it reveals how fast a containment plan collapses into theater the moment the logistics get inconvenient.

Is it worth it?

The obvious objection is cost. Building and operating anything on the Moon is one of the most expensive things our species knows how to do, and NASA's near-term lunar plans are already stretched across landers, habitats, and surface infrastructure^[6]. A robotic biocontainment lab on top of that is not a small ask, and it is fair to wonder whether the money buys down a risk we cannot even put a number on. The counterargument is the one insurance runs on. A risk stays acceptable right up until the exact moment it is not, and a self-replicating biological mistake does not sit down to recalculate the premium. It just spreads.

The people who plan these missions are not blind to the problem. Mars Sample Return already takes containment seriously in its own way, with a 'break the chain' philosophy meant to keep unsterilized Martian material from ever touching the outside of the spacecraft that carries it home^[6]. Whether the answer is a maximum-containment lab on Earth or a robotic outpost on the Moon is a real and unsettled debate, not a fringe one^[7]. The most useful thing this proposal does is force the question while it is still cheap to change the plan. A lunar facility is probably a long shot on cost alone. But the instinct behind it, to decide how careful to be before the samples are in the air rather than after, is the one that matters, because this is not a decision anyone gets to make twice^[8]. Almost every mistake in the history of exploration was, in the end, survivable and correctable. A living one, turned loose in our own atmosphere, would be the first we could not take back.

The supergiant isopod is one of those animals the internet adopted years ago: a deep-sea crustacean that can reach the size of a small dog, all armor plates and too many legs, like a woodlouse designed by a committee with a grudge. Its main claim to fame is going years without eating, including one captive individual that reportedly refused food for more than five years before it died^[1]. A team at the Institute of Oceanology under the Chinese Academy of Sciences, publishing in the journal Cell, has now worked out how the animal pulls this off, and the answer turns out to be a two-part system rather than a single trick^[2].

Why the deep sea starves you

To see why this is impressive, you have to picture the environment. On the deep-sea floor there is no sunlight and almost no local food production. Most of what arrives falls from far above as 'marine snow,' the slow drift of dead plankton and waste, punctuated only rarely by something large, a dead fish or a whale, hitting the bottom^[3]. An animal down there lives feast-to-famine on a schedule it does not control, and famine is the default setting. Survival means either burning energy to hunt for food that is not there, or evolving to need almost none at all.

A stomach built for the binge

The first half of the isopod's answer is storage. The researchers found that its stomach takes up roughly two-thirds of its entire body, a cavernous larder far larger than anything its shallow-water relatives carry^[2]. When a windfall does arrive, the animal can gorge and bank an enormous amount of it at once, then draw that reserve down slowly over the long stretch until the next meal^[4]. It is the biological version of buying in bulk because you do not know when the store will reopen.

The frugal engine

The second half is metabolism. The team reports that the isopod runs at an extremely low basal metabolic rate, the baseline energy cost of simply staying alive^[2]. Turn that dial down far enough and a full stomach can last an implausibly long time, because the body is barely spending. Big cold-water animals already tend toward slow metabolisms, but the study frames this as the other half of a deliberate pairing: a huge tank and a very frugal engine, evolved together to fit a place where food is both rare and unpredictable^[5].

Borrowed from bacteria

The paper's most surprising claim, and one that deserves a healthy dose of scientific skepticism, involves a gene called ND1 that is tied to suppressing energy metabolism in the cold. The researchers suggest that this gene appears to have been transferred into the isopod's genome from bacteria, an example of horizontal gene transfer, where DNA moves between unrelated organisms instead of being passed down from parents^[4]. Horizontal transfer into an animal is unusual, and the sort of finding that invites close scrutiny before anyone treats it as settled. But if it holds up, it means part of this creature's talent for near-starvation was, in a sense, borrowed from microbes^[2].

A few caveats are worth noting. The famous five-year figure is a reported maximum from captivity, not a routine, and captive animals behave differently from wild ones^[1]. And as with almost every metabolism study, the write-ups reach quickly for human applications: longevity research, obesity treatment, better aquaculture^[2]. Treat those as the hopeful coda they are, not the result. The actual finding is cleaner, and honestly more satisfying than any of them. A very large animal, in a place with almost nothing to eat, gets by on a giant pantry and an engine idled almost to a stop, with maybe an assist from a gene it picked up from bacteria.

Summer is here, and with it the seasonal sales. Plenty of storefronts are running discounts right now, but itch.io is worth singling out for one reason in particular: its open revenue sharing. Sellers there decide what cut the platform takes, anywhere from zero to a hundred percent, with a default of just 10 percent^[1]. In practice that means a larger share of what you spend lands with the people who actually made the game. The summer sale^[2] runs through July 6th, so here are three picks worth a look: two I just bought to try out, and one I already have and think more people should play.

Riftborne

Developer

Pitio Productions

Genre

Strategy, Simulation

Platforms

Linux (x86_64, ARM), Windows

Riftborne is about as unusual as a strategy game gets: a real-time grand strategy title that runs entirely inside your terminal, from developer Pitio Productions, on Linux and Windows^[3]. You start with a single base and grow it into a network of colonies, fleets, supply lines, and contracts. Along the way you build ships, take part in factional warfare, raid neighbors for rare resources, and train spies to infiltrate enemy bases for intel. The developer is upfront that this is a slow, long-form game built around patience and scale, with enemies that adapt to your playstyle over time and even across new saves. It is not a campaign you finish in a weekend.

A game that lives entirely in a terminal is easy to file away as a curiosity and move on, but it was the track record that actually kept it on my list. It released back in March, already sits above 90 percent positive reviews, and has shipped more than 40 updates since launch, alongside a community that looks both active and welcoming. At $6.39 during the sale, down from $7.99, it was an easy one to grab, and I plan to see how far my terminal empire gets this week.

Rebel Wars

Developer

Mananuk

Genre

Shooter

Platforms

ZX Spectrum, Linux, Windows, macOS, Android

Rebel Wars, from developer Mananuk, is a top-down boarding-and-rescue shooter with a twist: it was built for the ZX Spectrum, so it runs on original 1980s hardware as well as Linux, Windows, macOS, Android, and any device that can emulate the platform^[4]. You play a Star Alliance soldier raiding enemy corvettes for objectives like hostage rescues, data recovery, planting explosives, and hacking computers. There are four ship models to learn, access cards to track down for restricted areas, and 360 randomized mission combinations, so no two runs lay out quite the same.

You will not need a forty-year-old machine wedged in a closet to play it, thankfully, so I'll be running it through the Fuse emulator^[5] the developer recommends. At €0.50 on sale, down from €1.00, it is a cheap way to try a game made for the platform. If you want to go further, Mananuk also bundles ten complete ZX Spectrum games together as The Spectrum Compilation for €1.00, down from €2.00^[6], a solid starting point for anyone curious about the system.

Hypnospace Outlaw

Developer

Jay Tholen, TetroniMike

Genre

Simulation

Platforms

Linux, Windows, macOS

Hypnospace Outlaw, by Jay Tholen and TetroniMike, is the one on this list I have already played, and the one I most want to talk other people into. Originally released in 2019^[7], it casts you as a volunteer 'enforcer' moderating a fictional late-90s internet that runs on a remarkably detailed fake operating system. Underneath the period-perfect web pages and desktop clutter there is a real story, and a lot of small things to find.

Half the fun is bumping into things you were not looking for, so I will say almost nothing more about what is actually in there. If you enjoy sandbox games that lean on atmosphere and discovery, it is an easy recommendation, and at $4.99 during the sale, down from $19.99, there has rarely been a cheaper time to try it.

These are only three of the games that caught my eye. There are thousands more indie titles, developer tools, and game assets discounted until July 6th^[2], so it is worth browsing the sale yourself to see what stands out, and supporting the creators behind the work along the way.

The world's memory supply is being vacuumed into a handful of data centers, and the bill is landing in your hands. The scale of the boom driving that is hard to overstate. Back in April of this year, the global market collectively bought $110.5 billion of semiconductors, the first time the industry has ever cleared $100 billion in thirty days, and an astonishing 93.9 percent jump over the same month a year earlier^[1]. The trade body that tracks these things now expects the full year to close above $1.51 trillion, a milestone it did not expect to reach for years^[2]. For the semiconductor manufacturing industry, it's an unprecedented period of profits. For the rest of us, it is just the start.

There seem to be two competing narratives being pushed through the media at the moment. One says the memory manufacturers are gouging and abandoning ordinary buyers to chase the AI gold rush. The other, unsurprisingly argued most directly by the people selling the memory, claims you've misread the situation entirely, that the shortage is simply a brutal limitation of physics. While the manufacturers are technically correct, their latest business decisions and forced lock-in contracts paint a clear picture of their intent to continue brazenly abusing those limitations. The shortage is real, it is by design, and it has no chance of letting up soon. As long as the companies involved are allowed to get away with it, they will continue posting the kind of margins normally reserved for software monopolies. Digging into the numbers as they are today is the only honest way to untangle what is happening.

It started inside the fabs

Three companies, Samsung, SK Hynix, and Micron, control more than 95 percent of the world's DRAM production^[3]. When demand exploded for High Bandwidth Memory, the stacked, interconnected DRAM that is necessary for AI accelerators to function at higher bandwidths, those three made a rational choice. HBM reportedly carries margins near 60 percent against roughly 40 percent for ordinary commodity DRAM^[4], so they aimed their best capacity at it. The problem with this harsh shift is that wafer fabrication is close to a zero sum game. Every line they convert to produce memory for AI accelerators is a line no longer making the memory that goes in laptops, phones, and routers. The vacuum has created a force on the market that is just begging to have its long-term ramifications become very clear.

The rush to fill that vacuum has been fiscally brutal, even to the largest names in the market. Conventional DRAM contract prices rose somewhere between 90 and 98 percent quarter over quarter in the first three months of 2026, then climbed another 58 to 63 percent in the second quarter on top of that already inflated base^[5]. NAND flash, the storage side, actually outpaced DRAM in the second quarter with increases of 70 to 75 percent^[5]. The strangest symptom is at the bottom of the stack. Supplies of older nodes tightened so hard that DDR4 spot prices climbed past newer DDR5 in some configurations, an inversion that has started to turn the normal march of progress on its head^[6], and demand has since reached back even further, slowly dragging up the price of legacy DDR2 and DDR3 parts that were supposed to be effectively obsolete^[7].

The shortage comes for everything with a chip in it

The Verge put the consumer side of things plainly: the price of RAM has tripled, quadrupled, even sextupled depending on the chip, and it is not just a problem for people who build their own PCs^[8]. The damage continues to show up everywhere a computer hides. IDC figures memory is now 15 to 20 percent of the materials cost of a midrange phone, and the same firm that once expected average phone prices to rise about $9 now expects as much as 8 percent, with steeper hikes on cheap phones where the cost gets passed straight to you^[8]. Qualcomm's chief executive told investors a coming dip in its phone business would be "100 percent" down to the memory shortage, and added, with unusual candor for an earnings call, "we just wish there was more memory"^[8]. Game consoles, handhelds, even the next generation of PlayStation and Xbox have been repriced or pushed back for the same reason^[8].

The most overlooked casualties are the cheap boxes nobody thinks about. Counterpoint Research found that memory prices for consumer gear like broadband routers, gateways, and set top boxes jumped more than 600 percent, nearly seven times, over a roughly nine month stretch into early 2026, against a threefold rise for smartphone memory in the same window^[9]. These are devices built on razor-thin margins, and those margins have rapidly disappeared. A year ago, memory was around 3 percent of the bill of materials for a low- to mid-range router. Today it is over 20 percent^[9]. That is the kind of shift that quietly stalls fiber rollouts and keeps a whole generation of affordable consumer hardware from being built at all.

Micron says you have the story wrong

Into the chaos walked Christopher Moore, Micron's vice president of marketing for its mobile and client business, who sat down with Wccftech in January and politely told everyone they had misunderstood the situation^[10]. His argument, while delivered with PR-flavored and lawyer-approved fluff, is worth examining for what it is. Micron, he said, is still serving consumers, just through different channels, supplying memory to the Dells and Asuses of the world rather than selling sticks directly^[10]. The real driver, in his telling, is not malice but scale. The share of the market that data centers demand "used to be 30, 35 percent, and then to 40 percent, and now to 50 and 60 percent," and the entire industry is simply short. "This is not a Micron issue," he said, "it's an industry issue"^[10].

His second point is the one most worth explaining, because the industry issue is one of an industry with very few players. Building modern memory is not a simple endeavor. Every time a fab switches the density of chip it makes, say from a 12 gigabyte chip to a 16 gigabyte chip, total output drops while the lines retool^[10]. So Micron is now asking customers to hold their configurations steady to allow running as few variations as possible, and keep output volume up. And the new capacity everyone keeps pointing to will not arrive on the schedule people imagine. Micron broke ground on its Idaho facility three years ago and pulled its start into mid-2027, but in Moore's own words you will not see "real output, meaningful output" until at least 2028, once qualification and customer acceptance are done^[10]. On the engineering, he is right. The shortage cannot be quickly resolved, and the nearest hope of meeting demand is genuinely years out.

The margins say otherwise

Here is where the numbers start to warp reality, the income statements. In the quarter it reported on June 24, Micron booked $41.5 billion in revenue, up 74 percent in three months, at an operating margin of 81.2 percent^[11]. Its own breakdown shows the gains were almost entirely price, not volume: DRAM bit shipments rose in the low single digits while average selling prices climbed in the low 60s^[11]. That is not a company simply struggling to meet demand. That is a company having the best year of its life, made painfully clear in May when its market value crossed $1 trillion for the first time^[12].

Micron is not alone in this market, and it is not even the biggest winner. Samsung, the volume leader in conventional DRAM, raised memory prices 100 percent year over year in the first quarter and then, unbothered, raised them another 30 percent for the second^[13]. Its semiconductor division alone turned 53.7 trillion won in operating profit for the quarter^[14]. SK Hynix, meanwhile, posted a 72 percent operating margin and a net cash position around 35 trillion won, having paid down its debt to a rounding error along the way^[15]. The three suppliers have each enjoyed the most profitable quarters they have ever seen because of this sudden overwhelming demand, and the continued eye-watering price hikes are unlikely to break their pace for the foreseeable future.

The cavalry is not coming, at least not on time

The obvious fix, you'd rightly think, is to build more fabs at home. This is already underway, and already too slow. The U.S. CHIPS and Science Act put roughly $280 billion behind the effort, including $52.7 billion in direct support for chip manufacturing^[16]. The tier one projects are enormous. TSMC has expanded its Arizona footprint to about $165 billion, and Micron is anchoring a $100 billion campus in New York as well as a $50 billion operation in Idaho^[17]. But these facilities take years to build, and the timelines don't look great. Meaningful memory output won't be on the table until 2028 at the earliest. Subsidies can derisk a fab, they cannot make concrete cure faster.

And subsidies do not work everywhere. A $1.9 billion chip plant proposed by EMP Shield in Coffey County, Kansas, pitched as 1,200 jobs and a slice of the supply chain for rural America, was denied CHIPS Act funding and has gone essentially nowhere since^[18]. It is a painful reminder that you cannot conjure a semiconductor manufacturing industry by simply trying to fund and manufacture the fabs. The money will go first to the places that already have the labor, the logistics, and the incumbents, which is to say the places that have decades of supporting infrastructure and logistics ready to support this type of facility.

The only real exit is rebuilding the machine

If brute force manufacturing cannot close the gap fast enough, the next strategy might be to need less memory in the first place. That work is happening in university cleanrooms rather than megafabs. Through the JUMP 2.0 program, run with the Semiconductor Research Corporation and DARPA, researchers are chasing architectures that merge memory and logic instead of endlessly shuttling data between them^[19]. At the University of Kansas, that means atomically thin memory resistors aimed at neuromorphic computing, hardware that mimics the brain's synapses to fold storage and processing into the same tiny components^[20]. Done right, it would cut the sheer volume of DRAM an AI workload needs. While improving efficiency is far from a promise of satiated demand, the efforts are unlikely to make things worse, at least as far as Jevons Paradox, the tendency for efficiency gains to just spur more total consumption, can be avoided.

While memory used to be a commodity, bought and sold on a volatile spot market that rose and fell with PC demand, that market is effectively dead^[5]. The big buyers now lock in binding, multiyear supply agreements just to guarantee they can keep their machines running, and the suppliers have every reason to keep it that way. While trillion-dollar companies run by billionaires will continue to get taxpayer-funded subsidies to help pay the ever increasing rates, the rest of us will just continue to foot the bill.

Wine 11.12 is out, the latest in the project's roughly biweekly development series^[1]. The release notes list three notable changes plus the usual round of bug fixes.

The first is that Wine now bundles libswresample and libswscale, the audio-resampling and video-scaling libraries from FFmpeg, imported from its upstream 8.1.1 release. With them in place, Wine's resampler, color converter, and video processor are reimplemented on top of FFmpeg's libraries rather than GStreamer.

The bundled Mono engine, which runs .NET applications without Microsoft's runtime, is updated to version 11.2.0. The XSLPattern parser in MSXML has also been reimplemented, which resolves a long-standing syntax-error bug in several Corel installers, including Paint Shop Pro and CorelDRAW Graphics Suite X3 and X4.

Bug fixes

The release closes 27 bugs in total. Among them, Need for Speed Most Wanted no longer registers a continuous "up" input when a gamepad is connected, and Super Hexagon no longer ignores input after a selection is made on the title screen when a gamepad is present. The release also adds fractional-scaling support under Wayland and an option in winecfg for 7.1 surround sound output.

The source is available from WineHQ as wine-11.12.tar.xz^[2], with binary packages to follow from the usual distribution download sites.

Most software gets slower as it gets bigger. It accretes committees, hesitations, and the kind of caution that turns a year of work into a changelog nobody finishes reading. The Godot game engine has spent the last few years doing the opposite. Since the 4.0 rewrite landed in early 2023 it has been on a tear, and the new 4.7 release^[1] keeps the streak going, arriving stuffed with enough features that summarizing them honestly is a losing battle. I will try anyway.

Some of the additions quietly change how a scene looks. 4.7 adds a rectangular area light^[3], a light source shaped like an actual panel instead of an idealized point, which is how soft lighting behaves in the real world. If you have ever tried to fake a window or a softbox with a cluster of fiddly spotlights, this is the feature that deletes that whole workaround.

The one I would point a newcomer at, though, is the Godot Android Build Environment reaching a stable release^[2]. In plain terms, you can now build games on an Android phone or tablet, with the editor running on the device itself. That is a genuinely radical idea: the full toolchain for making a game, running on the cheapest computer most people already own. It is exactly the kind of access that the proprietary engines, with their desktop-class requirements and account logins, never bothered to prioritize.

So what are you waiting for? Go check it out.

The recommendation is an easy one, because the price is zero. If you have ever idly wanted to make a game, the barrier has rarely been lower: download it, follow one of Brackeys' tutorials^[4], and you can have something running by the afternoon. And if it earns a place in your toolkit, the project runs on donations^[5], which is worth keeping in mind.

The quiet story under the patch notes is a simple one: a free, community-built tool that keeps getting better on its own schedule. In a corner of the industry that increasingly rents you your tools, an engine you can download, modify, and keep is worth a look. Especially at this price.

There is a particular kind of science story that should make you slow down rather than speed up: the breakthrough that arrives precisely on a corporate marketing schedule. Microsoft has now done this more than once, announcing that it has built a quantum bit out of a brand-new state of matter. Each time the claim is dressed for maximum reach, and each time independent physicists go to the data and come back saying the same thing. It does not show what the announcement says it shows. At this point the repetition is not a run of bad luck. It is a method, and the thing being reliably manufactured is not a qubit but a headline^[1].

The dream is real, and it deserves a fair hearing. Microsoft is chasing a topological qubit, one that would store information not in a single fragile particle but spread across a state of matter assembled from elusive things called Majorana zero modes. If it worked, the qubit would be shielded from noise at the level of physics itself, which is the single hardest problem in quantum computing. That is a prize worth a decade of effort. It is also a prize that makes everyone, including the people chasing it, very eager to believe they have already arrived.

This is not the first time the arrival has been announced. In 2018 a Microsoft-funded team published a celebrated paper claiming to have seen the telltale signature of these modes. An outside physicist asked for the raw data the paper had left out and found that measurements contradicting the headline had simply been deleted from the graphs. Nature retracted the paper in 2021^[2], and the authors apologized for what an investigation called insufficient scientific rigour^[3]. A second related paper was pulled the next year. The lesson Microsoft drew was reasonable on its face: build a tool to take the fallible humans out of the loop.

The tool that was supposed to fix it

That tool was a piece of software, the Topological Gap Protocol, meant to scan the messy experimental data and return a yes-or-no verdict on whether the new state of matter was present, with no room left for wishful thinking. In February 2025 it underwrote the headline. Microsoft unveiled the Majorana 1 chip and described it, in its marketing, as the first processor powered by a topological core and proof of a new state of matter that had only ever existed in theory^[4]. The peer-reviewed paper underneath was far more modest, and the journal made sure everyone knew it: Nature took the unusual step of attaching a note stating plainly that the results were not evidence for the Majorana modes being claimed.

Physicists noticed the gap between the paper and the press release at once. The device, several pointed out, demonstrated a way to take a reading, not a working qubit anyone could actually control^[5]. Something might be in there, the careful version went, but they cannot steer it, and a thing you cannot steer is not yet a computer.

Then, in 2026, the supposedly incorruptible software was audited. Henry Legg, a theoretical physicist at the University of St Andrews, went through Microsoft's released code and raw data and published a critique in Nature. As AI Weekly reported, what he found was not subtle. The program contained basic coding mistakes, including one that scrambled the data by reordering it the wrong way. More damning, it carried a filter hard-coded to display only the single most favorable patch of a device and hide everything else, which is the automated version of the exact cherry-picking the tool was built to prevent. He also showed the verdict could flip from yes to no depending on an arbitrary choice about where to crop the graph. Loosen the definition of success a little, search a big enough field of noise, and you will always find a shape, the way people find a face in a piece of toast.

Microsoft's response is its own kind of tell. The company did not really dispute that the code did these things. It recast them as minor bugs, and recast the tool itself, sold for years as an objective referee, as merely a practical aid for tuning chips. The head of the quantum effort compared criticizing the software to doubting that airplanes fly because you dislike one dial on the dashboard, and waved at confidential evaluations by a government funding agency as evidence the work was sound. When you are caught hiding data, the honest move is to correct the record. Microsoft instead moved the goalposts and hid behind a classified shield no outsider can inspect. That is not the conduct of a company that wants to be right. It is the conduct of a company that wants to keep the headline.

Right on cue, a bigger announcement

Here is where the pattern closes the loop. Weeks before that critique appeared, Microsoft announced Majorana 2, a next-generation chip promising a thousandfold improvement, a new material discovered with the help of AI, and a headline qubit lifetime of twenty seconds. The twenty seconds is real, but it measures the wrong thing. It is how long the chip holds an ordinary, classical state, not how long it holds the fragile quantum superposition that makes a qubit useful at all. As Legg put it, a classical bit has a lifetime of years, and that does not make it a good qubit. The measurements that would actually demonstrate quantum behavior were left, in the paper's own words, to future work.

Lay the events end to end and this stops looking like science colliding with hype and starts looking like a playbook. A breakthrough is announced with a full marketing apparatus behind it. Outsiders find the evidence was massaged. A quiet correction lands somewhere almost no one will read it. And right on schedule, a larger, shinier announcement arrives to bury the bad news before it can travel. You do not have to prove a single measurement was faked to see the shape of it. The marketing never needed the physics to be real. It only needed the headline to land before the correction did, and it has now done exactly that twice.

That works because there are two audiences and two stories. The hedged, careful version goes into the journal, where the caveats sit in the margins and the editors have to bolt on a disclaimer by hand. The triumphant version goes into the press release, where no caveat survives. Almost everyone meets only the second one, and by the time a physicist publishes the rebuttal, the headline has already done its job on investors, partners, recruits, and the public.

There is something rotten at the core of this

The internal failure it points to is the part that should genuinely alarm people. A campaign like this does not escape a lab by accident. Somebody wrote the words new state of matter over a result the journal had already flagged as no such thing. Somebody approved those words. They passed through communications, through legal, through executive sign-off, and went out as a polished global rollout, and at no step did anyone with the authority to stop it decide that being wrong on purpose was a problem worth raising. A functioning company has a dozen people in that chain who can pull the cord. Microsoft shipped it anyway, and then shipped it again. You do not get there without something being badly wrong in the culture doing the signing off.

And the damage does not stay inside Microsoft. Every time one of the largest companies on Earth launders marketing through Nature, it spends down a kind of public trust that took a century to build and that no quarterly number will replace. People already struggle to know which science to believe, and corporations that treat peer review as a stage prop are a large part of why, degrading a shared resource for a temporary edge. This is also not the only corner where the company's internal compass looks broken. The same instinct, take the expedient path and manage the optics later, runs through its long habit of leaning on outside security researchers while dragging its feet on paying them, the backdrop to our reporting on the Nightmare-Eclipse zero-day streak. Different department, same rot.

None of this means the topological qubit is impossible, and the physics deserves to be said plainly, because it deserves better than the people marketing it. The idea is beautiful, and a real version would earn every superlative. But beauty is not evidence, a roadmap is not a result, and a press release is not a discovery. What would count is boring and specific: a qubit you can control along more than one axis, measured the same way more than once, on more than one device, with no software quietly choosing which data you are allowed to see. Until that exists, the honest way to read a Microsoft quantum headline is as what the pattern says it is. Not a dispatch from the frontier of physics, but an advertisement, and one the company has taught us to distrust the hard way, one buried caveat at a time.

For about ten weeks this spring, the two biggest operating systems on Earth told two very different stories about how computer security actually works. The more frightening story is not the one that made the front pages. On Linux, a run of serious kernel flaws set off the usual alarms across the security and dev-ops world, got dissected in the open, and were patched through upstream channels before anyone could weaponize them. On Windows, a single anonymous person with a grudge took Microsoft's defenses apart in public, one zero-day at a time, and is openly promising worse.

The comparison is not about which codebase is more broken. Both had genuinely dangerous bugs this spring. It is about who found them and what happened next. The Linux flaws were unearthed the hard way, by a sprawling open-source community and a roster of professional security teams reading public code. The Windows flaws were the work of one person, posting under the names Chaotic Eclipse and Nightmare-Eclipse, operating entirely outside coordinated disclosure. For the first few weeks, almost nobody outside security circles noticed.

It took a community to find them

The Linux flaws were not minor, and the security world did not treat them as such. They drew coordinated scrutiny across kernel mailing lists, distribution advisories, and the trade press, the kind of attention open code exists to attract. The bugs sat in load-bearing parts of the system. Two of them, CVE-2026-43284^[1] and CVE-2026-46300^[2], lived deep in the network stack, where a lost shared-fragment marker could let the kernel decrypt an encrypted ESP packet in place, over memory it did not privately own, a classic path to leaking or corrupting data that is supposed to be sealed. A third, CVE-2026-46333^[3], tightened the access-control logic ptrace uses to decide what one process may read out of another. A fourth, CVE-2026-31431^[4], tore a clever in-place operation out of the kernel's crypto layer and reverted to a safer copy.

What reflects well on Linux, rather than badly, is that every one of those bugs was found and fixed in daylight. They were caught by people who read kernel code for a living, reported through normal channels, assigned identifiers, fixed at the source, and folded into distribution updates, each changelog carrying the same plain verdict, that the vulnerability has been resolved. No proof-of-concept was dumped on an unsuspecting public, no working exploit raced a patch to users, and no wave of in-the-wild attacks followed. The noise was the system working as designed: thousands of eyes, many of them paid professionals at large security firms and national response teams, turning flaws into fixes before anyone could weaponize them.

One researcher, one grudge

The other streak began on April 3, when a researcher operating as Chaotic Eclipse posted a fully working Windows privilege-escalation exploit straight to GitHub, with no coordinated disclosure, no CVE, and no patch, alongside a message aimed at Microsoft's Security Response Center: "I was not bluffing Microsoft, and I'm doing it again." The grudge underneath it, by the researcher's own account, was an earlier disclosure attempt that went nowhere.

The exploit, dubbed BlueHammer, is almost poetic in its cruelty: it turns Defender's own machinery into the way in. As Cyderes picked it apart, it is a textbook time-of-check-to-time-of-use race. During an update-and-remediation pass, Defender briefly spins up a Volume Shadow Copy snapshot of the disk. BlueHammer baits a scan, then uses opportunistic locks to freeze Defender at exactly the wrong instant, leaving that snapshot mounted, and with it the SAM, SYSTEM, and SECURITY registry hives that are normally locked tight while Windows is running. From there the exploit reads out the boot key, decrypts the machine's stored secrets, and walks an ordinary user up to NT AUTHORITY\SYSTEM, the highest level of local control. The security product is the side door. Microsoft patched it on April 14 as CVE-2026-33825 and credited two other researchers, Zen Dodd and Yuanpei Xu. Nightmare-Eclipse went unmentioned, and the snub did not cool things down.

Out of the lab, into a breach

Two weeks later the floodgates opened, though you would not have guessed it from the headlines. BlueHammer went into active exploitation in the wild around April 16, as Security Today warned, tracked closely by a handful of vendors and largely overlooked everywhere else. The next day, as Help Net Security reported, the researcher dropped two more Defender flaws: RedSun, another privilege-escalation route, and UnDefend, which lets an ordinary user block Defender from receiving signature updates or switch it off entirely. Investigators soon found all three being used by a real attacker.

From there it stopped being a proof of concept and became an incident. Huntress, with corroborating reporting from Cyber Security News, traced a live intrusion that reached for the Nightmare-Eclipse toolkit after breaking in through a compromised FortiGate SSL VPN, ran hands-on-keyboard reconnaissance, and staged a tunneling binary that Huntress nicknamed BeigeBurrow for follow-on access. The intruder, by the investigators' read, was clumsy and not especially familiar with the tools. That is the quiet horror of a public exploit dump: it hands a near-nation-grade capability to whoever downloads it, skill optional.

By April 22 this had a government deadline attached. CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog, the list that, under a standing federal directive, legally obliges agencies to patch within a fixed window. The federal government runs on Windows, guards those machines with Defender, and encrypts their disks with BitLocker. Every one of those three pillars was about to be a headline.

Then they went for the disk

On May 13, the day after Microsoft's monthly Patch Tuesday, Nightmare-Eclipse went for the disk. They released YellowKey, a BitLocker bypass, and GreenPlasma, another route to SYSTEM. As The Register described it, YellowKey ships as files on a USB drive: plug it in, complete the right key sequence, and you are dropped into an unrestricted shell on a BitLocker-protected machine, without ever cracking the encryption itself.

YellowKey needs physical access, which usually earns a flaw a shrug. Not here. BitLocker is the thing standing between a stolen laptop and the data on it. Rik Ferguson of Forescout told The Register that if the claim holds up, "a stolen laptop stops being a hardware problem and becomes a breach notification." Gavin Knapp of Bridewell called it "a huge security problem for organizations using BitLocker," the kind that turns every lost device in a corporate or government fleet into a potential disclosure event.

Then Nightmare-Eclipse said the part that detonates the room: that YellowKey is not just a bug but a backdoor, allegedly injected by Microsoft itself. The experts who spoke to The Register were clear there is no way to verify that from anything published so far, and it should be treated as exactly what it is, an unproven accusation from a hostile, anonymous source. But it lands in a climate where the bypass is real, the exploitation is real, and the vendor is visibly on the back foot. In that setting, a claim does not have to be true to do damage. It only has to be plausible enough to repeat.

A ransom note, not a disclosure

By late May the fuller picture, pulled together by Barracuda, counted six zero-days in six weeks: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma. The last is a privilege-escalation bug tied to a flaw that was supposedly fixed back in 2020. The posts that came with them read less like disclosures than a hostage note, threatening a mass release of remote code execution flaws, the most dangerous class of bug, and claiming a "dead man's switch" rigged to dump more exploits on its own.

What happened next is best read straight from the researcher's own PGP-signed blog, and it should be taken for exactly what it is: the unverified word of a hostile, anonymous source. By that telling, the loudest threat fizzled. On June 9 he called off the mass drop he had set for July 14 and apologized for the panic it caused, writing that "the big thing is not happening" because a single exploit, RoguePlanet, had drained him. RoguePlanet shipped instead on that day's Patch Tuesday, the timing he says he favors to "create more pressure on Microsoft." He describes it as a race condition that began as a full remote code execution, set off by luring a victim into opening a booby-trapped disk image on a network share, until a mid-May Defender update broke the technique and left even him unsure whether it is still anything more than local privilege escalation. A second BitLocker bypass, GreatXML, followed a day later.

The quieter claim is the more unsettling one. In his telling, the exploits are built to run silently, using a Defender scan flag that suppresses the usual threat pop-up so that when the race succeeds, nothing warns the user at all, a trick he says he first spotted in real-world attack samples. He claims signature-based blocking does not hold, because small changes to the code slip past it, and that the only real mitigation is to wait for Microsoft to patch. Treat the specifics as a boast until a vendor confirms them, but the third-party incident reports already show these tools working in the wild.

Microsoft's public answer has been measured to the point of strangeness. After the first drop, its only comment was that it "supports coordinated vulnerability disclosure," a line about process offered to a person busy tearing the process to shreds. On May 15 it said it "is aware of the purported vulnerabilities and is actively investigating the validity and potential applicability of these claims across our platforms and services." The defensive guidance tells the rest: patch what has a patch, and for YellowKey, set a BitLocker startup PIN and a firmware password. Barracuda is blunt that this only hardens the machine, and that the flaw "may still be exploitable." The advice amounts to accepting that, for now, there is no fix. Read another way, it is the standard playbook for a hostile actor. Engage publicly and you validate their leverage. Starve them of oxygen and you at least stop feeding it. For a while that seemed to work. After the early flurry Microsoft went quiet, leaning on broad, behind-the-scenes mitigations in Defender rather than public statements, and by the researcher's own account the silence helped stall him, alongside a stretch of depression he says pushed him to step away. He even concedes the mitigations cut both ways: some of his bugs died, but the same changes, he claims, left Defender easier to evade in general.

This is where the government angle stops being abstract. The same agencies CISA orders to patch are the ones most exposed to everything else, because they bought the whole stack. Defender is the default guard on those endpoints, and it is the thing being turned inside out. BitLocker is the control that makes a lost government laptop a non-event, and it is the thing being bypassed. When one vendor's software is the ground floor for federal agencies, hospitals, courts, and utilities, a monoculture forms, and a monoculture has a property attackers love. One motivated person, with one grudge, can put all of it on the same clock.

Living in the shadow

Set the two streaks side by side and the asymmetry, not the bug count, is the alarming part. The Linux flaws, for all their technical depth, were the product of a vast public immune system: an open-source community and a long roster of professional research teams, all working to find and fix in the open. The Windows zero-days came from exactly one anonymous person who needed no committee and asked no permission. One side shows how security is supposed to scale. The other shows how little it now takes to put a near-ubiquitous operating system, and the governments and hospitals that run on it, on the back foot.

And the thing that turned a run of bugs into a crisis was never the code. It was the relationship around it. Linux's flaws went to maintainers. Microsoft's went to the public, dropped there by someone the company had, by his own account, already brushed off. Nightmare-Eclipse proved that the disclosure relationship itself can be the vulnerability, and that one is not on any Patch Tuesday list.

For a moment in mid-June it looked like the streak might simply burn out. The researcher announced a break, citing exhaustion and a bout of depression, and signed off with "hope we meet again, friends." It did not last. On June 23 he was back, declaring the break over and teasing a July drop of "really interesting and possibly insanely controversial findings," this time promising only enough code to prove the flaw exists rather than a working exploit. Take that for what it is, a taunt from an anonymous source with every reason to bluff. But the pattern underneath it is the real story. One person, with one grudge and no permission, can keep a trillion-dollar vendor and everyone downstream of it on edge for months, then walk away and walk back whenever he likes. The eclipse did not pass. It just proved it can come and go as it pleases.

Valve has finally put a price on the Steam Machine, the small living-room PC it has been teasing since late last year, and the number is steep. As The Verge reported, the base 512GB model starts at $1,049, the 2TB version runs $1,349, and bundling a Steam Controller adds another $79. For a box that hooks up to your TV and performs roughly like a PS5, that is almost double the price of the console it most resembles.

What is unusual is the company's response to the obvious complaint. Rather than apologize for the sticker, Valve turned it into a position. It is not subsidizing the Steam Machine, it does not intend to, and it would like you to understand that this is a feature. In remarks the company gave to The Verge and echoed in its own announcement, Valve essentially argued that selling game hardware cheaply, the way every console maker does, is bad for you.

The price comes with a philosophy

The financial picture is straightforward. A PS5 sells for around $600, an Xbox Series X for about $650, and even a PS5 Pro tops out near $900, all of them cheaper than Valve's machine while several are sold at or below what they cost to build. Valve is doing the opposite. By its own account it is selling the Steam Machine at roughly cost, with designer Lawrence Yang telling The Verge that 'the cost of the product is basically the cost of the components and what it takes to make it,' and engineer Pierre-Loup Griffais adding that the company is being 'more aggressive with margins' to land 'as close to cost as possible.'

The reasoning, in Valve's telling, is principled. On its Steam Hardware post, the company laid out the case plainly: 'The traditional console model is to sell hardware at a loss and make up the revenue with subscription services or by selling games that are locked-in to the hardware.' That, Valve argues, builds a closed system where you do not get to choose your software, while the open PC platform has driven hardware and software innovation for decades and is better for customers over the long run. Subsidizing hardware, in its words, runs counter to that. It is a genuinely coherent argument, and there is truth in it. Console lock-in is real, and a box you can install anything on is worth something.

Easy to say when you own Steam

It is also an argument that costs Valve almost nothing to make. This is a privately held company that prints money off the cut it takes on the largest game store on earth. It does not need to lose a dime on hardware to win, because it already wins every time a game sells on Steam, including games people buy to play on a PS5-priced rival. A console maker subsidizes hardware because the hardware is how it gets into the software business. Valve is already in the software business. Declaring the loss-leader model unhealthy is a lot easier when you have never needed it.

The timing sharpens the point, because the reason the Steam Machine costs what it does is not really philosophy, it is a parts shortage. As 80 Level detailed, Valve says the memory and storage crunch made its original price goal 'no longer viable,' and that the figure announced reflects component prices it locked in over the preceding six months. The crunch hit supply too: Griffais told The Verge the company is launching with about two-thirds of the units it had planned, and that at one low point it was not sure it could build any meaningful quantity at all. The no-subsidy stance arrives at the exact moment subsidizing would have hurt Valve's bottom line the most.

To its credit, Valve is not pretending the price is painless for buyers. Speaking to Rock Paper Shotgun, the company admitted outright that some people are going to be priced out, and would not predict whether prices might fall later, calling it 'too dangerous for us to speculate' while components stay expensive and scarce. The honesty is refreshing. It is also cold comfort to someone who just wanted an affordable box to play their Steam library on the television.

The frustrating thing is that Valve is both right and self-serving at once, and the two are hard to pull apart. Open beats closed, console walled gardens really are built to trap you, and a machine you fully own is a real good. But there is something rich about one of gaming's wealthiest companies framing cheap hardware as a thing to be suspicious of, when the alternative it is selling costs more than a thousand dollars and the customers it prices out do not get a vote in which model wins. The principle is sincere. It is also, conveniently, the most expensive way to play games in your living room in years.

Facial recognition usually arrives wearing the costume of safety, sold as a way to spot threats in a crowd. Madison Square Garden has spent years quietly demonstrating the other use case: scanning faces to keep out people the owner simply does not like. As reported by The New York Times, the company put lawyers from firms that were suing it on an exclusion list and turned them away at the door.

The case that made it infamous is almost cartoonish. A lawyer was denied entry to a Rockettes show because of who her firm represented, an incident that, as covered by NPR, became a national flashpoint in the debate over whether this technology keeps people safe or just hands institutions a new way to punish critics.

The pattern underneath is the point. When a private company can identify everyone walking in, the line between security and an enemies list is whatever management decides it is on a given day. A long investigation by WIRED described the result as a surveillance machine built around the personal grudges of its boss, not a safety system that drifted into misuse but one aimed at critics on purpose.

Then the internal documents leaked

Two recent leaks make that explicit. As reported by 404 Media, a breach spilled the company's internal data, including risk ratings attached to guests and to 'talent' such as former players and celebrities, sorted into buckets like low and high risk.

A second document, also surfaced by 404 Media, showed MSG keeping a dossier specifically on the activists who had organized against its facial recognition program, cataloguing their public comments and the tweets they had posted criticizing it. The watchers were, very literally, watching the people who objected to being watched.

Not a glitch, a strategy

Strung together, these stories describe something more deliberate than a misbehaving gadget. The exclusion list, the denied entries, the risk scoring, the activist file: each is a separate decision to point the same tool at inconvenient people, and each was made by an institution that faced almost no consequence for it.

The uncomfortable lesson is not that one arena is run by a vindictive owner. It is that the technology makes vindictiveness scalable. Give any institution the power to recognize every face at the door, and 'keeping people safe' and 'keeping critics out' become the same button. MSG just pressed it first, and in public.

Most of us picture GPS as a dot on a map. It is really a clock in the sky, and a startling amount of infrastructure quietly runs on it. That is why a long-theorized weakness now being exploited at scale is more serious than it first sounds. As reported by Space.com, satellites have now captured the full extent of GPS signal tampering from orbit, confirming that a lab-grade worry is happening out in the open.

The fragility is just physics. The signals come from satellites about 20,000 kilometers up, so they are faint by the time they reach the ground, and faint signals are easy to drown out or fake. Spoofing and jamming were always possible in theory. What changed is that they are now common enough to map from space.

The stakes run well past a confused phone. GPS is woven into aviation, shipping, power grids, and finance, all of which lean on its precise timing as much as its positioning. When the signal lies, the failures show up in places most people would never trace back to a satellite.

Fixes are coming, slowly. Researchers are working on ways to back the system up, from low-Earth-orbit navigation satellites to approaches^[2] that do not depend on one fragile signal from deep space.

The uncomfortable part is how much we built on something this easy to disrupt. A single faint decades-old signal turns out to be load-bearing for modern life, and the work of shoring it up is only now starting to feel urgent.

If TikTok has felt like a firehose of uncanny, low-effort video lately, you are not imagining it. Per 9to5Mac, close to 60% of TikTok videos are now AI slop, against roughly 21% on YouTube, and the platform is funneling the worst of it to the people least equipped to handle it.

The figure comes from a report by the editing platform Kapwing, which clocked nearly 60% of the clips served to brand-new accounts and to children as AI-generated. Newcomers and kids get the strongest dose, and that is less malice than math. The recommendation engine knows nothing about you yet, so it reaches for whatever is cheapest and most engagement-optimized, which right now means synthetic.

What it does to the youngest users

For young viewers it goes well past annoying. Writing in Mother Jones, researchers called it toddler-grade AI misinformation produced at industrial scale, and flagged the obvious risk to a developing brain that cannot yet tell a real explanation from a confident fake.

The scale is absurd on the company's own numbers. The Guardian reports that TikTok admits to hosting more than a billion AI videos, and has only just started testing a setting that would let you see fewer of them.

Notice that the off switch is arriving as a new, optional feature rather than the default. That tells you who the current setup is built for. Synthetic video is cheap to make and cheap to push, it keeps the feed moving, and the work of sorting real from fake gets quietly billed to the viewer, kids included.

TikTok is not uniquely villainous here. Every feed-based platform is drifting the same way as generating content gets cheaper than making it. But TikTok is the cleanest example yet of a feed where the slop is not a glitch. For a lot of users, especially the new and the young, the slop is the product.

Most research on gender and negotiation has studied a deficit, the ways women are said to lose at the bargaining table. A large new study in PNAS turns the lens around and finds something less expected. Across experiments with more than 2,000 participants, people consistently reported better experiences negotiating with women^[1].

What stands out is how stubborn the preference is. It held even in anonymous negotiations, where the counterpart's gender could not be seen or guessed, and even when gender was assigned at random. So this is not just people favoring women they already know to be women. The pattern survived conditions built specifically to rule out plain stereotyping.

What it did not move was the money. The researchers found no difference in economic outcomes. Women and men closed equivalent deals. The entire gap sat in subjective value: negotiating with women left people more satisfied and keener to come back for the next deal.

Looking for the why, the authors went through transcripts of real negotiations and traced the effect to relationships. On average, women built stronger rapport over the course of the exchange, which lifted their counterpart's satisfaction and appetite to negotiate again, and did so without any cost to the final terms.

That detail matters, because the usual story holds that being liked costs women something when they bargain. This points the other way. The added likability carried no performance penalty, and a counterpart who wants to deal with you again is exactly the kind of advantage that compounds over a career. It is a healthy counterweight to a field that has mostly tallied women's disadvantages.

One of the more unsettling medical puzzles of the past decade is the steady rise in early-onset cancer, diagnoses turning up in people well below the age the disease usually targets. A new analysis reported by WashU Medicine offers a thread to pull. Younger generations appear to be aging faster biologically, and that accelerated aging tracks with the increase.

The idea doing the work here is that biological age and calendar age are not the same. A body can run ahead of the candles on the cake, worn down faster by some mix of environment, diet, stress, and exposure. A body that is biologically older is more exposed to the diseases we file under later life, cancer among them.

If each generation reaches a given biological age sooner than the last, that helps explain why cancers once treated as problems of old age keep appearing in people in their thirties and forties. It reframes early-onset not as the disease striking randomly younger, but as bodies that are effectively older than their years.

It is worth being precise about what this is: an analysis pointing at a link, not a verdict on cause. The honest summary is that the question is now sharper, not settled. But it lands on something a lot of people already feel uneasily, that the modern environment may be quietly speeding up the clock, and that the bill is arriving earlier than it used to.

The headline number is almost cartoonish. NVIDIA says 35 new AI supercomputers are going up across 23 European countries, adding up to hundreds of exaflops of compute^[1]. Set the superlatives aside and what remains is a plain statement of where the AI buildout actually lives: in concrete, power-hungry buildings, not an abstract cloud.

This is the part of the AI story a chatbot demo never shows. The models are the visible product. The foundation under them is a vast, costly layer of silicon, cooling, and electricity. The company's newest architecture, aimed squarely at this kind of scientific workload^[2], is what turns a research ambition into something a country can run.

It is not only chatbots pulling the power. The same class of machine is headed into hard science^[3], from physics to materials to climate modeling, where large-scale simulation has always been the bottleneck. The AI boom is, conveniently, also a supercomputing boom for fields that have wanted this compute for decades.

The open question is sustainability, in both senses. These machines burn serious energy, and the spending assumes demand that eventually has to justify itself. A continent's worth of new supercomputers is a bet as much as an achievement.

As a snapshot of the moment, though, it is hard to beat. The AI race increasingly comes down to who can build, power, and host the most compute, and that contest is now pouring concrete across a whole continent. Whoever owns the buildings owns a large share of what comes next.

Upscaling has quietly become the most important feature in PC gaming, the trick that lets a modest graphics card punch well above its weight. So AMD pushing its FSR 4.1 upscaler out to more Radeon cards in a new driver release^[1] matters more than the dry patch notes suggest.

The reason is simple. Upscaling splits the resolution you render from the resolution you see. Render fewer pixels, rebuild the rest intelligently, and a card that should be wheezing is suddenly holding a smooth frame rate. It is the closest thing to free performance the industry has going.

What has people genuinely excited is a leak^[2], spotted through Proton on Linux, hinting that a variant of the newer tech may run on older hardware than AMD officially supports. If it pans out, owners of last-gen and budget cards could get a real upgrade without spending a cent.

The usual cautions apply. An unofficial, leaked path is not a supported feature, and something working in a test is not a promise it will work well for everyone. Still, the direction is welcome. The most pro-consumer move a GPU maker can make right now is keeping older cards useful, and squeezing modern upscaling onto them does exactly that.