Tech News Weekly 461 Transcript

Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.

Mikah Sargent [00:00:00]:
Coming up on Tech News Weekly, I kick off the show by talking about Amazon's latest Alexa devices, the whole host of products. Then Joseph Cox of 404 Media stops by to tell us about what's going on with Proton right now and its AI push. Zack Whittaker of TechCrunch gives us the lowdown on PHP to Shell, and D. Griffin Jones of Extraordinary gives us everything we need to know about Apple's hardware announcements from this week. Stay tuned for this episode of Tech News Weekly.

Mikah Sargent [00:00:44]:
This is Tech News Weekly, episode 461, with me, Mikah Sargent, recorded Thursday, October 29th, 2026. The Mac Finally Gets Touchy. Hello and welcome to Tech News Weekly, the show where every week we talk to and about the people making and breaking the tech news. I am your host, Mikah Sargent, and this week I've got 3 interviews planned for you. But before we get there, you know, we spend a lot of time on this show around Apple events talking about the hardware that Apple announces. And today will not be any exception to that because later in the show, I've got someone coming on to talk about just that. Before that, I thought it would not be a bad idea to give Amazon its time in the sun because, you know, Amazon used to hold these big fall events or one big fall event essentially, and then kind of pile dozens of gadgets onto a single stage.

Mikah Sargent [00:01:46]:
That's where that twerking bear came from a long time ago. And the clock on the wall that would have the little timer built in. I still have an Amazon smart microwave thing. They would try a bunch of stuff and see what stuck. But this year, the company did something a little different because much like Apple has this fall, it spread its launches across the whole month of October. And this week was finally, I think, the part that people were most waiting for, or at least the part that people would know the most about because this was the week of Echo. Amazon laid out 5 new devices for the home. And the, of course, our friend Jennifer Pattison-Tui of The Verge was there in person to get hands-on, or I don't know if she was there in person, but she certainly got hands-on time with the products at the press event in New York City.

Mikah Sargent [00:02:47]:
There's, for one thing, a new flagship smart display, and looks and feels a lot like the other sort of smart displays that can pivot and move that you may have seen. And it's a little pricey, but understandable for what it is. There's also a speaker that before this point didn't have a camera, but now has a camera, and a bedside clock that aims to figure out when you're sleeping. There's a smarter Echo Dot and, Also Amazon's first photo frame, digital photo frame. All of it runs, of course, on the latest version of Alexa Plus, and it all comes just a few weeks after Apple made its own push into the smart home. So let's start with the Echo Show 16. This is the big, expensive flagship device. I don't know why I went into Dracula there, but it is October, so woo! Amazon says that this is its most powerful and versatile Echo Show yet.

Mikah Sargent [00:03:48]:
16-inch display has 10% more viewing area than the 15, as you might imagine, and this time done up in anodized aluminum, and it's also 40% thinner. Now, prices: $499.99, so $500 for the standard version, $570 for the NanoMat anti-glare display. It says that that NanoMat anti-glare display will cut glare by more than 90% and is the same if you have an ALEXA tablet Tablet 12 Pro, it's the same display as you get there. Pre-orders are open now for it, and if you pre-order, you get $100 off, which is nice. Amazon says it'll ship later this year. It's in fact the only device that Amazon has only announced and not made available. You cannot yet buy it today. As far as features, full Fire TV experience built in, so you can use it as a Fire TV.

Mikah Sargent [00:04:50]:
It has a remote and Better audio. JPT was talking about the 8 custom micro woofers and the 2 tweeters. 13-megapixel wide-angle camera. So this is actually a rather wide field of view for Echo Shows. And as you might imagine, it's got auto-framing for video calls. Also, shout out to Jammer B for linking to the good old twerking bear in the Discord. For the first time on an Echo Show, the camera actually has night vision. So it can watch you while you move around your home.

Mikah Sargent [00:05:28]:
Visual ID is improved, and this is a really cool feature that can see, try to determine who you are, and then give you, you know, prompts and responses that are unique to you. And of course, it's got better computing power and sensors so that it is able to kind of understand you moving throughout your space. As far as Tui's take on it, or GPT's take on it, she said it was big, gorgeous, and eye-wateringly expensive, double the $250 Echo Show 11 and $200 more than Apple's new Home View. As far as the kind of software features that were part of this announcement, there's something called Screen Styles. and it will turn your home screen on this device into a dedicated mode that's unique to you. Options include a family organizer with color-coded calendars, chores, and meal plans, a smart home dashboard, full-screen photos mode. I think that that is what's going to set this apart from other smart displays in terms of making it a true, true hub that, you know, people have been asking for. And, In fact, GPT agrees, saying that that is kind of what sets this apart from the competition, but also it's something that people have wanted from their Alexa devices and have not yet had.

Mikah Sargent [00:07:10]:
Of course, with this, you get a lot of cameras. The new Echo Studio with Home Camera puts a camera in Amazon's best sounding speaker, $250 in graphite. There's an optional $40 stand and Right now, the current Echo Studio is $220 if you don't want the camera included. When you do add the camera, you get live view in the Alexa app so you can check in on the house. Also visual help. So for example, hold up a board game box and it'll give you the rules if you've lost them. You didn't staple them inside the inside of the box? Come on. A cereal box would let you reorder cereal.

Mikah Sargent [00:07:52]:
And of course, video calls also part of it. Audio is the same as the sort of non-camera version. It's got a woofer, 3 drivers, Dolby Atmos, and does that special feature that we've seen from a lot of smart speakers, which is advanced room adaptation. So it tunes the sound to the room. As far as Echo Time, available for $200, and it is a design that has a 3.2-inch circular touchscreen, a bunch of different clock faces that you can do. It's got licensed faces— Batman, Superman, Wonder Woman, Green Lantern, the Powerpuff Girls— and a smart alarm that tracks your sleep so that it will wake you up during your lighter sleep cycle— or stage, I mean— anywhere within 10 to 60 minutes of when you set the alarm. That's because of the OmniSense temperature and presence sensors that are built in and ultrasound that aims to detect breathing and proximity, so you don't have to have it rely on a wearable to do so. Sleep Sensing, obviously opt-in, and if you press that mute button on the top, then it will turn off Sleep Sensing.

Mikah Sargent [00:09:14]:
Tui says that— I should say JPT because I've never called her Tui. JPT says that her favorite feature that's an upgrade here is that you can set an alarm by touch, so that way you won't wake your partner by talking to Alexa at night, which is nice. As far as the price though, $200, not so, not so exciting. Then Amazon's first digital picture frame. It says, Amazon of course says, this is the only photo frame with a— oops, I said it. Sorry, John. With Alexa built in, $199.99 in black. And then you can also get one with real wood for $230.

Mikah Sargent [00:09:56]:
10-inch touchscreen, semi-matte anti-glare finish. And it will sync from Amazon Photos. So that, of course, if you're a Prime user, you have that unlimited photo storage. And it does not, according to The Verge, it does not show ads. And that is a nice feature for sure, because Amazon is wont to do so. Unfortunately, right now does not support importing from Google Photos just yet, but maybe one day it could. ALEXA Plus, its smart features can pick photos by faces, by time, by sentiment. So that way it'll favor, you know, photos with smiles in them, good lighting, that kind of a thing.

Mikah Sargent [00:10:40]:
And it's even seasonal. So if you have, you know, recent celebrations, you can do that as well. The Echo Dot is available for $100 and it has built-in eero Wi-Fi. So if you do have an eero network, it can extend that as well. It's also got a better chip inside. so that it works as part of the AI acceleration for on-device processing. And there's a lot more to dig into that JPT has covered, including a really improved Alexa Home Map, which is a 3D view of your home that you can enter. Of course, Amazon would want this, but the point is to give you an idea of where the devices, your smart devices are inside of your home.

Mikah Sargent [00:11:28]:
You can read more about it from Amazon's own announcements, as well as from our wonderful JPT over on The Verge. All right, let's take a quick break before we get to our first interview of the show. All right, we are back from the break. Now, Proton has spent more than a decade building its reputation as this sort of careful privacy-first alternative to big tech, but there's some new reporting That suggests inside the company there's a very different pace and sort of vision that has taken hold, one driven by a push toward AI. Hmm, I think we've heard of that before. That has employees wondering where they stand. Here to walk us through what he found is 404 Media's Joseph Cox. Welcome back to the show, Joseph.

Joseph Cox [00:12:17]:
Absolutely. Thank you for having me.

Mikah Sargent [00:12:19]:
So before we get into your reporting, for anyone who isn't familiar with Proton, can you tell us kind of what is the company, what does it make, and what has it built its reputation on?

Joseph Cox [00:12:30]:
Yeah, so people probably best know Proton for ProtonMail, which is an end-to-end encrypted email service. They created it in the wake of the Edward Snowden revelations, with those being in 2013 and the company coming into fruition in 2014. And the idea, of course, was that you would send an email and nobody else can read it. And a lot of people flock to the product for that. Activists use it, journalists, sometimes government officials, or whoever just wants a more secure, private way of communicating. And Proton has really sort of grown on that idea of security, privacy, and I think trust as well, where it's not just an email provider now. There's basically sort of Google Docs and Google Sheets equivalents within Proton. They also have a VPN.

Joseph Cox [00:13:18]:
I think they have a 2-factor authentication app as well. So it started as an encrypted email provider. And now it's much more of a general suite of privacy and security tools.

Mikah Sargent [00:13:30]:
Got it. Now, you did report earlier this week that Proton plans to, quote, re-interview staff about how they use AI. And I really thought because of Proton's, like what I knew of Proton, I thought at first when I just saw the headline that I was about to read an article where Proton was asking its employees, hey, are you using a lot of AI here? Because if that's the case, we need to talk about it. You should probably be using less. What did that internal email say about the process and how are employees interpreting it?

Joseph Cox [00:14:05]:
Yeah, very much the opposite to that, in that Proton does use AI internally and has sort of released products externally as well. They have a chatbot which is very privacy-focused. It doesn't keep your logs, it doesn't train on your data, that sort of thing. This is different in that internally the CEO of Proton, Andy Yang, really wants people to be using AI. You know, he talks about using Claude a lot as well and really wants developers, engineers, sort of all parts of the company to use AI aggressively. So this email goes out to, I think, essentially everyone at the company and says, we are going to to re-interview people inside Proton to ask them how they're using AI. And it's very much to figure out, well, what are you doing with AI at the moment? And what do you plan to do with this technology as well? It is much more to identify people who are already using the tech and they may be ahead and they may actually get promoted as well. Yeah.

Joseph Cox [00:15:07]:
In light of these re-interviews. And if you're not using it, I mean, maybe now is the time to start using it. That's the message from company leadership. And Maybe if you don't, it might be time to find a job elsewhere. That is the strong implication. We haven't had these interviews yet. They're gonna happen in November. But that is how everyone I spoke to read these emails.

Mikah Sargent [00:15:28]:
Wow. A very get-on-board sort of situation. Now, one of the moments that you described comes from a security Slack channel. There's an engineer who suggested taking time to pen test new code. How dare you take time to suggest or to pen test new code before shipping it? Can you walk us through how that conversation went and then what the CEO told the team.

Joseph Cox [00:15:52]:
Yeah. So just to say the timeline, I published this article about these re-interview emails. I then get leaked a lot of Slack messages from the recent past, including, you know, May up to August and September and that sort of thing. This conversation you reference happened in late August. And this engineer working at Proton said in the security Slack channel, you know, it's okay to use AI, and I'm paraphrasing, but Andy, talking to the CEO, we really do need to review this code. We need to pen test it to make sure it's secure, you know, before we push it out to users. And Yen, the CEO, said, that's BS, and I'm abbreviating, that's where we're there. That's, that's BS and loser thinking.

Joseph Cox [00:16:37]:
Of course it's possible to be fast and secure. He then said, stop thinking always of how to be slower and focus more on how to be faster. He sent a follow-up message saying, only losers think like that, again on the idea of reviewing code for a couple of days. And ultimately the message was, stop lovingly handcrafting all our code and use AI more. And I decided to open this new investigation with that because I really think it sums up 2 things. The 2 prongs of this investigation, which are the aggressive adoption or forcing of AI in Proton, which might be against some security principles potentially, obviously on a case-by-case basis. And then also this really inflammatory culture of fear that the CEO has instilled among his employees.

Mikah Sargent [00:17:28]:
Yeah. Wow. Loser thinking is— that's some Those are some words, my goodness. Proton's CTO, Bart Butler, also posted a so-called AI manifesto. Can you tell us what that document lays out for the future of engineering at Proton? Sounds like, you know, we've kind of— the writing's on the wall there, but how did staff react to that when it landed?

Joseph Cox [00:17:52]:
Yeah, the manifesto, which I got a few copies of, is kind of exactly what you would expect from a CTO writing an AI manifesto saying, talking to engineers, your job is over, you are no longer writing code, your job is now to, you know, help the LLM write code faster or better and that sort of thing. And of course, that's a sentiment we hear all across all sorts of different industries, not just cybersecurity and privacy, but tech more broadly and that sort of thing. It still took employees by surprise because, you know, up until very, very recently, AI wasn't even really approved for use inside Proton. But this year, and especially the latter half of this year, something has changed, not just in Yen's tone and then this AI manifesto, but obviously with the re-interviews and the work that's being demanded of all these people. Proton, or leadership, is now trying to shift Proton very much into a heavily AI-focused company, including security.

Mikah Sargent [00:18:52]:
And beyond the messaging from leadership, What is your understanding of how deeply AI is actually woven into the day-to-day work? And what did internal documents you reviewed show about the business pressures behind the push?

Joseph Cox [00:19:06]:
Yeah, I mean, frankly, Proton is using a lot of Claude, according to everybody I've spoken to. I got leaked audio from one meeting where the CTO said that 90% of code in Proton in the month of October was written by AI. So that can give you a sort of idea of the scope and the scale here of the AI use. Of course, with these re-interviews, we're probably gonna see more AI use if people want to continue to work at Proton, presumably. As for the business pressures, I think this was probably the most telling thing where when people think of Proton, they may think of some, you know, omnipotent, very generous foundation, NGO, or a company, so it depends which way you look at it, that's trying to do it for privacy and privacy's sake, right? I got this internal document that was leaked to me, and it said that Proton is concerned that it's not going to beat or match its annual revenue targets this year, and its growth is slow, and they believe that this is an underperforming company. So enter AI, and also a bunch of other labor stuff as well, such as you know, trying to get people to work from 9 AM to 9 PM for 6 days a week. That trend, very popular in China, increasing in Silicon Valley. That's a little bit more tricky for Proton because it is a European company, and Europe, of course, has very strict labor laws.

Joseph Cox [00:20:27]:
But behind all of this AI transformation, at the end of the day, there are kind of very cold, calculated business decisions at the end of it.

Mikah Sargent [00:20:37]:
Absolutely. Now, several of your sources, described this hesitancy to speak up internally. What did employees tell you about raising concerns? And then, can you tell us about how reactions have been when they are pushing back publicly, so to speak, in Slack?

Joseph Cox [00:20:56]:
Yeah, so it does happen, but it is relatively rare that I think someone will push back against Yen, the CEO, in Slack. Um, because as you heard in one of the earlier examples, you're basically going to get mocked or you're going to get put on blast in front of basically the, the entire company, right? And then I heard this idea of a culture of fear from one source, and then I went to a bunch of other people and I asked them, like, do you agree with that? Like, how would you phrase it? Like, is it a culture of fear? And the vast majority agreed with me. You know, they would say that we don't want to speak up because you're going to get mocked into these, um, in these Slack channels. Uh, what the CEO says goes, essentially, even if he doesn't have the expertise in a lot of cases about the particular issues being discussed. Uh, and then some people have just, you know, they're just shutting up and getting on with it because, well, you— what can you do? You can't fight against the CEO. And it, it was really staggering seeing some of these Slack messages where I've seen Slack messages from a lot of of companies over my years. I've been leaked a lot of Slack material from all sorts of different tech companies. I haven't quite seen a CEO talk like this to their employees, frankly.

Mikah Sargent [00:22:07]:
Yeah, it's kind of shocking. Or not kind of, it is shocking to me. Proton's, this also kind of blew my mind. Proton spokesperson really didn't dispute your reporting and even acknowledged that many people there are anxious. Is this like a— is this a spokesperson with morals? Anyway, what should Proton's users take away from all of this? And then what are you watching for as those re-interviews get underway in November?

Joseph Cox [00:22:38]:
Yeah, I mean, look, it's up to individual consumers where they go with their money and that sort of thing. I'm frankly like less interested in that. It is very much a personal individual decision. Maybe you move from Google, then you move to Proton. You're like, well, now I don't like Proton or whatever. That's up to the individual person. It's totally up to them. I am more interested in, yes, what happens in these re-interviews now? Like, are people going to be let go? Are people going to have to scramble to find use cases for AI just so they can keep their job here? I, I didn't even mention this in the piece, but I did already hear that some people were token maxing, as in like, I'm just going to whip up an AI tool and try to use as much Claude usage as possible so maybe I can keep my job here.

Joseph Cox [00:23:22]:
Frankly, we're probably gonna see more of that in the coming weeks in the lead-up to these re-interviews.

Mikah Sargent [00:23:27]:
Wow. Well, we will be keeping an eye on you keeping an eye on that. Thank you so much for taking some time to join us today. If people want to keep up with the great work that you're doing, where should they go to do so?

Joseph Cox [00:23:41]:
They should just go to 404media.co or check out The 404 Media Podcast. You search it, you'll find it.

Mikah Sargent [00:23:47]:
Awesome. Thank you so much. We appreciate it.

Joseph Cox [00:23:49]:
Absolutely.

Mikah Sargent [00:23:50]:
Alrighty folks, let's take a quick break and then we will get into our next interview. All right, we are back from the break and it's time for our next interview. What happens when a piece of technology that's holding up most of the web turns out to have a crack in it? Well, this week, We found out because companies, governments, website owners around the world raced to fix a pair of critical flaws before those, those ever-watching attackers could get to them. So did the internet dodge a bullet or is there more danger ahead? Joining us today to talk about it is TechCrunch's own Zack Whittaker. Hello, Zack.

Zack Whittaker [00:24:32]:
Hey, Mikah, how you doing? Thanks so much for having me.

Mikah Sargent [00:24:35]:
Absolutely. Thank you for being here. So let's start with kind of laying the foundation for folks who aren't developers. What is PHP? And why does a flaw in something that most people have either never heard of or haven't heard of in a long time, why does it matter so much to the websites they're using every day?

Zack Whittaker [00:24:53]:
Okay, so PHP, in simple terms, is a web programming language. It's kind of a core technology that broadly allows websites and web apps to function. As a web visitor, you might not see it, but it's almost certainly there in the background of of your many, many open tabs. PHP has been around for years, decades in fact, so much so that it's ubiquitous on the internet. It's practically everywhere. It's used on servers, it's used on websites, apps, web-based games, you name it. It's really popular because it's an open-source technology, which means it's free, and it's also just really easy to use for any web developer to to jump in with. So much so that it's run by something like 70% of the web, runs some version of PHP.

Zack Whittaker [00:25:41]:
That's kind of the problem here, is that any kind of security issue in widely used software like PHP could affect a lot of people. In this latest case, researchers found 2 bugs in PHP that can now be exploited, meaning that this requires website owners and and big companies to take action and patch. And that's kind of why last week we saw governments and major websites taken down to try and get their websites fixed as soon as possible.

Mikah Sargent [00:26:10]:
Speaking of, this was one of the aspects that really surprised me. These bugs were first spotted back in 2024, but weren't patched at the time for reasons that I'll ask you about. What changed? And then who figured out how to make this something that needed to be addressed?

Zack Whittaker [00:26:34]:
Right. So this is a common kind of occurrence in what's known as vulnerability disclosure. Someone might find a bug, but how severe is it exactly? Can it be exploited? Sometimes, sure, but oftentimes also not so much. And that's kind of what happened back in 2024 when researchers initially discovered these bugs, the PHP Foundation, which maintains the software, couldn't actually figure out how it could be exploited. As an open-source nonprofit, they can only do so much with the resources that they have. They're massively underfunded, and this is kind of the case with, you know, a lot of open-source projects, many of which actually run much of the technologies like PHP on the web today. So the bugs that were actually found at the time in 2024 were never really fixed. They were deprioritized because they weren't seen as something that was a major issue that they could be exploited.

Zack Whittaker [00:27:26]:
But that changed earlier this year when researchers at a firm called Kaliph found the bugs again, and they actually found that they could be exploited. The PHP Foundation essentially realized the severity of the bugs in this case, realized that they could be exploited, realized that they you know, it was a really big deal for a lot of people, and they rolled out patches for the bugs as soon as they possibly could.

Mikah Sargent [00:27:51]:
Got it. I mean, one of the things that I think people are wondering is, what is it that makes, as we now have a term, PHP2Shell especially bad compared with a typical security flaw? And then can you kind of help all of us understand what an attacker can actually do with these exploits?

Zack Whittaker [00:28:16]:
Right. So these bugs, as they go, they're pretty bad, to be honest. There are 2 of them. And at worst, they allow what's known as unauthenticated remote code execution, which simply put means that anyone with a working exploit can launch an attack over the internet on an affected system running PHP, like a website, they can plant malware or other malicious software on that system, and there's no need for passwords or any credentials to log in. That's a real problem because that's like punching a hole in your web server, the equivalent of essentially. Without any additional mitigations, you could result in some serious issues with your web server, with your website, such as server compromise, or even a hacker taking full control of that system. The worst part of this is that if it's on a network, then the hacker could potentially access other systems on that same network. So it is a real problem if these bugs are exploited.

Zack Whittaker [00:29:19]:
The vulnerabilities are actually an issue with what's known as memory faults. It's a common theme with really old and aging programming languages and software that we see on the web today. I think something like 75% of the bugs that are exploited today are actually related to memory flaws. Memory flaws in software can be corrupted, leaked, overflowed, and spilled in a way that allows the hackers to essentially take advantage of that software. A lot of software and technologies these days have progressed from these memory-unsafe languages to what's known as memory-safe languages. They can't be exploited in the same way that PHP can be in the same way today. That's kind of helping mitigate some of the fallout, but PHP is run on so many websites these days, from WordPress to other major content management systems. So a lot of properties and web properties and websites out there are affected by this.

Mikah Sargent [00:30:17]:
Yikes. Now let's talk about how the fix was rolled out. Can you walk us through the process, the embargo, the early head start that some companies seem to get, And why it— or excuse me, what it looked like on Wednesday when banks and hospitals and retailers actually started to pull their sites offline.

Zack Whittaker [00:30:41]:
So yeah, this was, as we said, as I mentioned earlier, you know, with coordinated disclosure, it's really key. You don't want these bugs exploited before folks can patch them, especially with something like PHP. Because it's so huge and widely used. Coordinated disclosure, just in a nutshell really, is when a software vendor, like in this case PHP or another tech vendor, they essentially privately alert a bunch of trusted companies, like their customers, who might be most at risk from these security flaws. It helps them to get ahead of any potential future attacks. Because PHP is open source, it means that source code can be inspected, which means any kind of bug fixes will be very apparent really quickly as soon as the bugs are patched, which could actually help attackers get ahead. The information about the patches was kept within a really small group of big companies, and it was held under embargo, so essentially a time and a date in which the information could be released, and that was Wednesday. The embargo mostly held, right? But the PHP Foundation did throw a little shade at one company who released patches a few hours early.

Zack Whittaker [00:31:58]:
So come Wednesday, patches were kind of broadly available, allowing anyone to kind of fix their own systems. Thankfully, because the embargo broadly held, a good chunk of the web was already fixed by this point. That's obviously a good thing, but not everyone was able to get part of this embargo, and a bunch of websites, governments, major retailers, and other large web properties had to shut down their websites and block them off from the internet so they could patch them ahead of any potential attacks. It really wasn't clear at the time just how widespread exploits would be for this attack. Mm-hmm. Um, but so far it seems like we've largely escaped, um, you know, what could have been a significant wave of, of mass hacks.

Mikah Sargent [00:32:48]:
And this was something else that I, I saw that kind of was striking to me, which is, of course, after this was announced and we saw the rollout, then you have an opportunity to say, let's take a look at where this has or hasn't been exploited. Amazon says it saw exploitation about a week before patches were available. So can you tell us, how do we— what do we know about how that might have happened? Was it, you know, luck? Was it something else? And what did the PHP Foundation say specifically about how that embargo might have played a role?

Zack Whittaker [00:33:29]:
So Amazon has enormous visibility into what's going on the web because it powers so much of the backend internet. A lot of websites are hosted on Amazon, and Amazon said it found exploitation about a week or so before this embargo lifted. I will say it's not entirely clear who exploited the PHP bugs or even how ahead of time, but as I said earlier, you know, the embargo did break, but only by a few hours, and it's not not really enough time in this case to develop a working exploit. So there could be reasons for prior exploitation before this Wednesday embargo lift, and that could be for a few reasons. Maybe the embargo broke more than we realized. It's possible that there may have been a leak of information. Someone maybe passed on some information to someone else, and maybe that got leaked. It's also possible that there may have been espionage, such as a government or a nation-state spying on someone and then uncovering the information as part of that espionage.

Zack Whittaker [00:34:33]:
All these bugs could have been discovered entirely independently. The exploitation that we've seen goes back to about last week or so, the week before. So exploitation's only been recently detected. It's possible that more logs and more evidence will come out to show that the actual attacks do go back potentially further. But it is worth noting though that the exploitation of these bugs is said to be quite difficult actually. Researchers said that it wasn't that easy to develop these kind of exploits. But exploits are being built, and it is kind of a matter of time before they're used and available and being traded by malicious malicious hackers and cybercriminals to use. So there is some exploitation going on out there.

Zack Whittaker [00:35:21]:
There's not a huge amount of visibility into how widespread it is, but it seems to be relatively low in terms of what could have been a sizable attack. For its part, I think CISA, the US cybersecurity defense agency, says that there has been exploitation, but it hasn't really said much more than that right now.

Mikah Sargent [00:35:42]:
And you mentioned this researcher, the researchers that were involved in this, and it's kind of hard to figure out who discovered it first and that kind of thing. I know that OpenAI and I think it was— well, I know for sure OpenAI.

Zack Whittaker [00:35:55]:
Yeah. Wiz as well was involved in that. Yeah.

Mikah Sargent [00:35:57]:
And so they said that they— the way that they found it was in part through AI. How much did AI actually contribute to the discovery? according to them? And then why does that actually matter for how things go forward from here?

Zack Whittaker [00:36:16]:
So AI contributed a little to the discovery, but by all accounts, not much. The bugs were always exploitable, but nobody could really figure out exactly how until recently. And so the Caliph researchers earlier this year, they found a way to exploit the bug. They kind of had a few things, actually quite a few things, really kind of working in their favor from a human point of view, in the sense that their researchers had institutional knowledge of PHP to begin with. They had a strong understanding of its codebase, and they also understand generally how to target exploits at the software. So they had a lot of institutional knowledge and information that really helped them understand the issues with the software to begin with. The researchers did use a little AI to unearth the exploitability factor, but they said, and I quote, no model is simply capable of unearthing all bugs with simple prompts, at least not yet. Which is to say that AI helped a little bit, but humans did most of the work.

Zack Whittaker [00:37:26]:
And as you mentioned, there was mention of OpenAI and Wiz being involved in this. It's because the researchers were a part of an initiative that was run by both OpenAI and Wiz, and both of those companies validated the bugs and confirmed their exploitability. But yeah, this is one of those situations where we've seen behind the scenes of how a major vulnerability, or 2 vulnerabilities in this case, could have been exploited in a massive way. But also, we largely escaped what could have been a sizable situation otherwise. But it's not to say that we're going to escape this completely for the rest of time, because there are a lot of technologies out there that the internet relies on that we still haven't really unearthed the many, many vulnerabilities in those as well. So we're not out of the danger zone.

Mikah Sargent [00:38:17]:
Exactly. Yeah, that's kind of how I hope we can round things out today is by giving us a little bit of an understanding about what may still be out there, what, what researchers are saying, you know, to be prepared for, and the current state of the internet now that AI agents are running around doing their thing.

Zack Whittaker [00:38:44]:
Yeah. So for its occasional flaws, granted, PHP has been pretty reliable over the years, right? But this kind of situation could and probably will happen again. I wrote my story a few days ago that there have been a few times in my career where I've like really held my breath as a security reporter. And in 2017, there was a WannaCry ransomware attack on the British NHS using US government hacking hacking tools. That was a pretty bad situation. We all probably remember a few years ago, I think 2 years ago now, where CrowdStrike had that outage that knocked out Windows computers around the world. It was absolute havoc. We can see this situation happening again and again because the PHP situation was one of those another day where I thought this was going to turn out badly, if I'm completely honest.

Zack Whittaker [00:39:35]:
Thankfully, the first wave of exploitation was minimal. There were no real major mass hacks. And I think that's in part because the bugs were tricky to exploit, but also that the embargo for the coordinated disclosure broadly held. But it does mean that potentially millions of sites are still vulnerable to these particular PHP bugs, which means that these sites could be hacked in the future as part of future attacks if they're if they're left unpatched. There's also the problem with legacy tech like PHP and other similar kind of technologies that have been around for decades, is that people who might have implemented PHP on websites 10 or 20 years ago might not be here anymore. And so nobody knows that it's necessarily there in their technology stack. And so there are also lots of other aging technologies on the web today that are kind of waiting waiting to be hacked and compromised in different ways. So I don't think we're going to see the end of this, but I do think that taking this kind of similar approach that we've had already of finding bugs, reporting them in a private way, getting them fixed, and getting them fixed in a way that reduces harm to as many people as possible, I think that's probably the best kind of approach going forwards.

Zack Whittaker [00:40:53]:
But to say that the internet is held together by Twigs and Sticky Tape, it's honestly not that far off, actually.

Mikah Sargent [00:41:01]:
Lovely. Well, thank you so much for taking some time to be here today. I'm glad you're watching The Twigs and the Sticky Tape. If people would like to stay up to date with the work that you're doing, where are the places they should go to do so?

Zack Whittaker [00:41:14]:
I would just check out techcrunch.com/security. I also have my own blog and newsletter that goes out every week at this.weekly. So you can check out that.

Mikah Sargent [00:41:24]:
Thank you so much, Zack. We appreciate it.

Zack Whittaker [00:41:26]:
Thanks so much for having me. I really appreciate it.

Mikah Sargent [00:41:28]:
All righty, folks. Up next, we've got Apple hardware. So we'll take a look at that in just a moment. Back from the break. And as I promised, it's time to talk about Apple because, well, Apple didn't need a keynote stage to have what we can pretty much call a big old week. Over 3 days, the company has laid out quite the refresh— Macs, iPads— and one of those updates crosses a line that Apple seems to have held firm on for years. Joining us to make sense of it all is D. Griffin Jones of Extraordinary.

Mikah Sargent [00:42:10]:
Welcome, Griffin.

D. Griffin Jones [00:42:12]:
Well, thank you for having me back again, Mikah.

Mikah Sargent [00:42:14]:
Yeah, absolutely. So let's start with, I think, the most, uh, Most important and certainly most talked about thing from this week. It's the display on the new high-end MacBook Pro. What is ProLED XDR? Why does Apple choose to have these special names for its display tech? How is it different from the screens that MacBook Pros have used up to now?

D. Griffin Jones [00:42:40]:
Well, really quick rundown. An LED display, which is what most traditional flat panel displays have been for a while, since like the 2010s or so, have one giant backlight and then each pixel on the screen tries to filter that light down. So you get extremely bright whites and vivid colors, but the blacks have a little bit of that light shining through. You can't get like a pure black. Um, a mini LED display, which is what the MacBook Pros currently have, that's like, you know, the mid-range technology for displays right now, a mini LED display, instead of having one giant singular backlight, it has a bunch of them, either between like a few or in the MacBook Pro's case, it has like several hundred. And that can give you like pure blacks in areas that are mostly black. But I mean, the canonical example is if you have a star field, then you'll have pinpricks of white light shining through and that can sort of make the black like that can glow, have like a halo effect around that black around it. These new MacBook Pros have an OLED display where each individual pixel Lights itself.

D. Griffin Jones [00:43:44]:
Uh, so you can have extremely bright colors where you want bright colors and extremely dark blacks on a pixel-per-pixel level. It's the best kind of display technology that's affordable right now. And, uh, the only problem with OLEDs is that they can't typically get as bright as an LED. But what Apple does is, just like the iPad Pros, they stack 2 OLED displays on top of each other. It's a tandem OLED. display. And, uh, it's the same technology that we've seen on the iPad since the M4 iPad Pro and the M5, except inexplicably Apple decided to give this one a new name. Are they actually— is the ProLED display different from the tandem OLED display in the iPad Pro? They seem to be the same based on how Apple is describing it, but it has a new name now.

Mikah Sargent [00:44:33]:
Oh, all right. Now this is the other aspect of this new ProLED display. display, that same MacBook Pro is the first Mac that you can touch. How does touch work alongside the keyboard and the trackpad? Is it similar to what we've seen from other touch laptops and touch computers? And what happens with apps that weren't built with it in mind? How does the software adapt for a touchscreen MacBook?

D. Griffin Jones [00:45:03]:
I think the thing to keep in mind here is that Apple hasn't completely reimagined macOS. It's the same macOS that you still know and love. You don't have to touch the screen if you don't want to, and it'll work just fine. They haven't, they haven't gone full toaster refrigerator like Windows 8, to borrow Tim Cook's metaphor from long ago. But, uh, you know, if they have a developer video out where if you don't update your app for touch, it'll work pretty much how you expect. You tap once to simulate a click. So, you know, you can You can tap once to just select a file in the Finder, for example, or select a button or whatever. You can swipe with a single finger to scroll.

D. Griffin Jones [00:45:39]:
They don't make you use 2 fingers like you would on a Mac's trackpad, for example. They borrow the more familiar iPhone and iPad gesture and that most other PC laptops with touchscreens do. You can tap and hold to do a right-click or bring up the context menu, which is a— I mean, that's how that works on the iPhone as well. You tap and hold on a button to get the context menu. They're borrowing— I mean, this is— it's the first time a touch display has been on a Mac, but Apple has been doing touchscreens for a long time now. You won't really be surprised. It's there mostly for— and what Steve Jobs said all those years ago is still true. If you only use a touchscreen, your arm will get tired for a long time.

D. Griffin Jones [00:46:18]:
But, you know, it's just there for when you want it, when you're showing this computer to somebody else or, you know, trying to share something or play a video and the other person doesn't want to reach down and between your hands and use your trackpad or take your mouse away. They just want to swipe something over and they can do that now.

Mikah Sargent [00:46:36]:
Nice. This MacBook Pro is also— Apple has highlighted thinner, noticeably lighter, starts at $2,899. So now it's time to ask the question that every tech reporter loves being asked. Which is, who is this machine built for?

D. Griffin Jones [00:46:55]:
It's currently— Apple does this whenever they want to bring the MacBook Pro to the next level. Like when they transitioned from the MacBook Pro to a Retina screen, they had— they introduced the MacBook Pro with Retina display as a separate model that was above the other ones. And then it took like, you know, 2, 3 years for it to fully replace the regular MacBook Pro. And again, when it transitioned of the Touch Bar. So right now, this sits above the regular MacBook Pro. You can still get a MacBook Pro with an M5 Pro and M5 Max chip with the exact same computer inside, the same chips, the same storage, the same memory configurations. But if you just want a little bit more all around the board, I mean, that's how Apple pitched this. It's everything you love about the MacBook Pro, but everything that you care about is just a little bit better.

D. Griffin Jones [00:47:43]:
The better display, obviously. It's a little lighter, so it's more comfortable in your backpack. It has better speakers. If you want to have tomorrow's MacBook Pro right now, you can spend an extra $400 and get it. Probably a year from now or maybe 2 years from now, this will just be the standard MacBook Pro design and all of them will switch over to having these extra features. But right now, if you haven't burned all of your money getting the specs you want, then you can spend a little bit more and get a

Mikah Sargent [00:48:12]:
Now, a day earlier, Apple announced, as we've kind of been talking here, the separate 14-inch MacBook Pro with M6, $1,999. Of course, no OLED, no touch, but that newer chip generation than the current M5 Pro and M5 Max. How should someone that's shopping for a MacBook Pro then And you did touch on it there at the end, but I think for people who maybe aren't as familiar with the way that Apple does things, what is the flowchart that we could, one could go through to kind of figure out which one is right for them? Because as you point out, touch may not be, even for the people who go for the Touch Bar or the Touch Bar, the touch version, it may not be something that they use regularly. So how do you decide?

D. Griffin Jones [00:49:04]:
Well, that entry-level MacBook Pro has always been a tough cookie to crack, or you don't really crack cookies, a tough cookie to dip.

Mikah Sargent [00:49:13]:
There you go.

D. Griffin Jones [00:49:14]:
Because you— it has the same M-level base M-level chip that you get in a MacBook Air. But what do you get there? Um, you get the mid-tier display and you mostly get the extra ports. That's always a bonus if you, you know, if you're— if you look at the MacBook Air and you're like, you know, I want more than 2 things to plug in, the entry-level MacBook Pro is a good option for you. And you get the mini LED display, which is still, to be clear, a very excellent display. It's just not the tandem OLED display. Um, from there, I mean, if you want more performance, you get the, the, the Pro version. I'd again say I would spec out the computer you want and see where that lands you. And then if you have $400 left, then upgrade to the, to the Touch version.

D. Griffin Jones [00:49:57]:
But I mean, personally, even as someone who works in graphic design, I mean, I'm sure those OLED displays are going to be fantastic, but the mini LED displays that the MacBook Pros currently have are also excellent, to be clear.

Mikah Sargent [00:50:09]:
Yeah, I agree. Now moving along to the iMac, it moved to M6 this week as well. Beyond the chip, what else changed in terms of the iMac and who now is the iMac for? Or is it for the same as it was? have called it the family computer or the kitchen computer. Is it still that? Is it something else? Tell us what changed there.

D. Griffin Jones [00:50:38]:
Well, it is still an excellent home computer if a home computer still has a place in your life. I mean, you also see them in like hotels or businesses if you want like an all-in-one computer to just do a little simple web work. It's a great machine for that. You know, the all-in-one design makes it really simple, easy to set up, easy to buy. Uh, to be honest, not a lot changed beyond the M-series chip inside. It now has higher speed Ethernet in the Ethernet jack that's been upgraded from 1 GHz to 2.5. So I'm sure iMac users will enjoy that if you want the fast hardwired connection. Uh, and that is the The only thing that changed.

D. Griffin Jones [00:51:20]:
Yesterday you could buy it with an M4 chip, which was, you know, 2 years out of date. Now it's better. So it's a very simple update. Uh, they didn't change the colors, which is excellent because I honestly love the colors that it comes in. 6 gorgeous colors and also silver.

Mikah Sargent [00:51:37]:
Then we also have the iPad Mini. Apple is calling this the, the biggest iPad Mini update ever. OLED, water and dust resistance, which I think is interesting, A20 Pro, and a front camera that's on the landscape edge. Uh, when you look at the changes that have hit here, which of them do you think matters most to the people who actually do use the iPad Mini? And do you have any insight into who the iPad Mini has been for and in theory continues to be for?

D. Griffin Jones [00:52:10]:
The iPad Mini is always at its best when Apple treats it like just a smaller screen size of the iPad Air. Sometimes the iPad Mini sort of gets away from them and they don't touch it for a while, but whenever it's updated, I mean, they always, they always bring their A-game to it. And this is a— I think Apple, maybe not as big of a leap as when it got to the all-screen design, but this is a huge refinement upon that. The OLED display. display is excellent. I mean, it's not Apple's tandem OLED display. Uh, this— they still want to keep it in an affordable price point, but having a, you know, a single-layer OLED display is a huge upgrade to it. That's what made it so much thinner than before.

D. Griffin Jones [00:52:51]:
I mean, having an LED display with a separate backlight layer, that's what makes— that's what contributes a lot of thickness to the device, and it's a whopping 15% thinner, which is a huge improvement. Uh, they were able to make the bezels smaller. So although it is still mini, you get a little more screen inside it. I mean, the waterproof and dust resistance is excellent because a lot of parents, I am told, give iPad minis to their kids, you know, before they're maybe ready to have a phone that they carry with them all the time. You know, an iPad mini is comfortable for a small kid to handle. It's not super big. And having water and dust resistance on the iPad is a Huge improvement. I mean, it's kind of surprising that Apple hasn't brought any waterproofing, at least in official terms, to an iPad before, but I'm really glad to see it here.

D. Griffin Jones [00:53:39]:
Yeah. Uh, I'll be curious to see how the speaker quality is affected, having the speakers play through a much smaller opening around the edge of the display compared to having the speaker holes, but I think that's an excellent improvement. I'm honestly excited for that change to come to the iPhone as well. Uh, Now I think equally big news is what this iPad Mini doesn't have. It still doesn't have Face ID or a ProMotion display, probably in the interest of keeping the cost down while all of the component prices are going up, even considering that how the price had to be hiked up to $699, which you don't really want to see for an iPad Mini, but it's a sacrifice they had to make. And unfortunately, that also means the iPad Air, which is due to get the same changes next spring, probably won't have Face ID either, which is disappointing. But

Mikah Sargent [00:54:27]:
yeah, that's where we are. Uh, lastly, Siri AI, which of course shows up in every one of these announcements. But of course as well, the fine print says it's still in beta and some server-based features have daily usage limits and expanded access will cost extra down the road. So when it comes to Siri AI, What should buyers keep in mind as they decide whether to upgrade, and should it be part of their thinking when they're making these purchases?

D. Griffin Jones [00:55:04]:
Uh, Apple still calls it a beta, but you know, Apple doesn't really ship incomplete products. They're very proud that Siri AI is finally out, and it is good. And it actually is good after having tested it for a number of months. It does everything that it says as it can do in the commercials. Imagine that. And everything that Apple has been promising for the last few years. But it's not going to, I think, radically reshape the way you use your devices. If AI is a big part of your workflow, I don't know if Siri AI will be that impressive to you.

D. Griffin Jones [00:55:34]:
You can probably keep using Claude or ChatGPT, and it'll be more helpful, honestly. I mean, the other day I was I was writing an article based on, like, a— that largely went along with a podcast episode that I had recorded as well. And I was curious, what happens if I throw a transcript of this podcast to Siri AI and see if it tries to convert it to a blog post for me? Now, to be clear, I don't use AI in my writing. I actually already had the article written. I was just curious to see what Siri would do.

Mikah Sargent [00:56:07]:
Yeah.

D. Griffin Jones [00:56:08]:
And it rewrote either the first few paragraphs or the last few paragraphs of the podcast, but its context window is so much smaller that it wasn't able to handle the whole thing. So you have to keep that in mind. Siri AI isn't going to transform the way you do work. It's not as powerful as these other AI services that are mostly having their costs amortised right now. But it is good if you just want a personal assistant, if you just want to ask your phone questions and have it answer them for you better than before. I mean, that's what it's for. But I don't, I don't know if it's worth upgrading solely for that.

Mikah Sargent [00:56:46]:
Lastly, with that, I mean, there's lots of, of talk in the marketing, um, copy about local AI by way of the upgraded chips. Do you think that Apple Is aware, I guess, of where those limitations might be and therefore, uh, offering the ability to run local AI by, uh, improving upon the chips? Or is that just a matter of, hey, it's what people who are looking for these devices want, so let's make it available to them and tout it?

D. Griffin Jones [00:57:24]:
I think Apple sort of walked themselves into this not knowing that was the plan. I mean, when they started designing the Apple Silicon architecture, I mean, they've been making Apple Silicon since 2010 with the A4 chip. And when they brought it to the Mac, like, the unified memory architecture ended up being exactly what you would need for local AI. But they launched the M1 chip in 2020 before this was even on Apple's roadmap. I mean, we know Apple wouldn't even realise AI was important until a few years after that. So they've sort of stumbled into this where they happen to make the best AI computers in the world. But now they're leaning into it. I think that although Siri AI performance is not as good as these other leading-edge models, Apple also has to— Siri AI is also a service Apple basically runs for free.

D. Griffin Jones [00:58:14]:
So it's not going to be as powerful. I mean, but if you want to have That doesn't mean that the Mac isn't good for running other AI models. I mean, they're really proud of the fact that you can get a Mac Studio with 512GB of memory now, link 4 of them together, and have real server-quality power at your fingertips just sitting on your desk. And they're also really proud of the fact that these 4 Mac Studios that you can link together, they just plug into regular outlets. You're not running a server farm. You're not running a data center. You're just, you just got 4 computers on your desk. Now those 4 computers cost a grand total of $100,000, but that they're very proud of it. But hey, it's possible.

Mikah Sargent [00:58:59]:
Uh, well, I want to thank you so much for taking the time to join us today to walk us through the hardware that Apple announced this week. Uh, there were some software announcements as well. And, you know, it keeps on keeping on. But if people would like to keep up with the work that you're doing and check out those blog posts that you write, not AI writes, where are the places they go to do so?

D. Griffin Jones [00:59:27]:
I blog at dgriffinjones.com. That is where I have my blog Extraordinary. I'm still writing out my full thoughts on this week's announcements, and I have a podcast called Fresh of Griffin that you can find in all the major podcast clients, services, etc. And I'll have an episode out later today with Casey Liss of the Accidental Tech Podcast breaking down all of these in gratuitous detail, as Casey tends to do.

Mikah Sargent [00:59:53]:
Wonderful. Thank you so much, Griffin. We appreciate it.

D. Griffin Jones [00:59:55]:
Thank you for having me. Talk to you later.

Mikah Sargent [00:59:57]:
Bye-bye. Alrighty, folks, that brings us to the end of this episode of Tech News Weekly. Of course, you can head to twit.tv/tnw to subscribe to the show in audio and video formats. If you would like to follow me online and check out the other work that I do, you can find me @mikahsargent on many a social media network or head to chihuahua.coffee. That's chihuahua.coffee where I've got links to the places I'm most active online. Be sure to check out my other shows on the network, many of which published today, including Hands On AI and iOS Today. And then on on Sundays, you can also check out Hands-On Tech. Thank you for being here, and I'll catch you again next week for another episode of Tech News Weekly. Bye-bye!