The apps and tools worth your time, and the free ones that quietly beat the paid subscriptions you have been sold.
On 1 September SonicWall disclosed two zero-days in its SMA 1000 remote-access appliances, one of them a maximum-severity flaw, and both, SonicWall says, already under attack. CISA gave federal agencies just three days to fix them. Here is exactly what is affected, what is not, and the builds you need.
On 31 August Google removed the last Manifest V2 extensions, uBlock Origin included, from the Chrome Web Store. It is the final step of a phase-out that has run since 2024, not a sudden ban. Here is what actually changed, why Google and its critics disagree, and where full uBO still runs.
Researchers documented a ransomware crew using Cursor's AI coding agent, powered by Claude, to help break into companies. It is a milestone, but the AI assisted a human, it did not attack on its own. Here is what happened, and how to defend against it.
You do not need to pay for this. We tested the free background removers and found the trap most people fall into, plus the genuinely free tools that give you a full-resolution cutout, including ones that never upload your photo at all.
On 24 August, CISA added a CVSS 10.0 Oracle flaw, CVE-2026-21962, to its Known Exploited list with a three-day federal deadline. It reads like an emergency zero-day but is not: Oracle patched it in January 2026. What changed is the KEV listing, not the bug or the fix.
Researchers at ASSET detailed GhostSplice, which makes AI coding agents leak local secrets by splitting a refused request across trusted channels, each fragment harmless alone. It roughly doubled compliance, from 42 to 82 percent, though Claude models mostly refused. A warning about how agents combine tool inputs.
On 17 August, CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited list with a three-day deadline; it lets a malicious web page reach a developer's local Ray dashboard and run code. It is narrower than the scary numbers, which belong to an older Ray bug.
On 20 August, attackers pushed malicious versions of three popular Rust crates, led by arrayref, with 245 million downloads. The malware ran at compile time, not runtime, so merely building a project could infect you. A registry supply-chain attack, not a Rust flaw; the team pulled all three within about 90 minutes.
In March, attackers hijacked the vulnerability scanner inside LiteLLM's build pipeline, stole its package-publishing keys and pushed two poisoned versions to PyPI. They were live only about 40 minutes, but a Python auto-run trick did the rest. Researchers estimate the fallout put credentials from more than 2,500 companies at risk.
Microsoft's monthly security fixes have exploded: a record 570 in July, nearly 400 again in August 2026, up from a then-record 200 in June. The reason is not that Windows got less safe. It is that AI now finds bugs at machine scale, and Microsoft says giant monthly updates are the new normal.
Linus Torvalds has made it official: arguably the world's most important open-source project 'is not one of those anti-AI projects.' At the same time, the volunteers who maintain the Linux kernel are being buried under a flood of AI-generated bug reports and patches. Both things are true, and together they are the story of open source in 2026.
With Muse Code, Meta has launched its own AI agent that writes, tests and ships software from your terminal, going straight at Anthropic's Claude Code and OpenAI's Codex. Its headline trick is running many AI coders in parallel without them tripping over each other. Here is what it is, what's genuinely new, and the honest caveats.
AI tools now let people describe an app in plain English and ship it without writing code, nicknamed 'vibe coding.' It is genuinely empowering, and it is producing a wave of live apps riddled with basic, avoidable security holes. Here is what the scans find and why AI-written code fails this way.
In two weeks last July, the EU's tech law forced a court defeat on Apple, ordered Google to share search data with rivals and AI chatbots, and hit Google with its first fine under the act. Here is what happened, why the three events differ, and why it could reshape Big Tech.
For most of its life, the world's biggest code registry ran strangers' scripts on your computer the moment you typed 'npm install'. After a brutal year of supply-chain attacks, npm v12 finally turns that off by default. Here is what changed, what did not, and what it means if you write software.
Adobe Acrobat Pro is a subscription, and Acrobat Reader, the free one, cannot actually edit a PDF. Here are the free tools that merge, split, compress, sign and genuinely edit PDFs, including one that never uploads your files to anyone.
Adobe Premiere is a subscription at about $23 a month, and Final Cut costs $300. Meanwhile the best free video editor in the world is used to finish Hollywood films and costs nothing. Here are the free editors worth your time, from pro-grade to social-ready to the one already built into your PC.
Photoshop is now a subscription you rent forever, from about $20 a month bundled with Lightroom to $23 for the app on its own. You do not need it. Here are the free photo editors that do the same jobs, from a full desktop suite to an editor that lives in a browser tab.
Microsoft Office is now a $100-a-year subscription, and for most people that is money thrown away. Here are the free office suites that open your Word and Excel files, do the same job, and cost nothing, including Microsoft's own.