What do you get when you cross a bored teenager with free time and excellent computer skills? A hack of a Microsoft database with trillions of records on hand and 25,000 records of employee data, of course. Future legend hacker Faav poked around Microsoft's supposedly internal Titan analytics platform, eventually finding that its user validation was... sub-optimal.

According to Faav, he's "spent the year hacking Microsoft off and on around school," digging up bugs on the Redmond firm's wares as well as Amazon, Google, Adobe, and others. Much like other hackers, he has his own set of tools, and predictably in this day and age, his sonic screwdriver is Antares, an AI orchestrator bot he concocted for the purpose of scanning and automating boring security legwork.

Antares found an endpoint URL in Titan that brought up an error message saying that a VPN was required. Just like a virtual pspspsps, this was enough to get Faav's attention. He got Antares to look for subdomains around this endpoint, coming up with one belonging to an Azure Cloud host, along with a corresponding Swagger/OpenAPI file listing four routes (Swagger is an industry-standard machine-readable instruction on how an API works, for easier third-party integration).

While three of those routes needed Azure Active Directory authentication, one did not, and its name was inspiring: /v2/Query. It also accepted raw SQL queries, prompting a collective facepalm from the audience. Faav still needed to know what to query for, and after clever usage of the Wayback Machine, he found a 2023 version of this login page, complete with a helpful Apache Superset configuration file describing the database schema, showing 56 table definitions.

He also found that this endpoint refused his queries due to the lack of a JWT (JSON Web Token) authentication, so he sicced Antares on it again for 10 days, with no success. Eventually, Faav had a flash of inspiration and realized that the way the server was responding implied that the token's digital signature wasn't being checked. So he just pretended his access token was for an administrator and was promptly let in. One handy "SHOW DATABASES" later, he was staring at 25,000 records of employee data, along with organization records, dashboards, and charts.

After exploring the database a little more, he found a particular data source for Bing analytics. Digging there and tallying up rows across tables, Faav saw he had access to a total of 17 trillion records total, and had to double-check this number and stop himself from yelling out and waking his parents at 2 am.

After reporting the problem to Microsoft's bug bounty program, he was awarded with $5,000 for his findings. In his blog post, he also points out that "AI and human intuition compounded here. Antares did ten days of work I didn’t have to [...] Its persistence, plus one human hunch, is what made this find possible."

Microsoft launched the Copilot+ brand in 2024 to differentiate its offerings with local AI capabilities from other devices that do not have NPUs or fail to meet the minimum 40+ TOPS requirement. But a little over two years after the disastrous launch and poor sales, the company has quietly moved away from the brand. Microsoft Surface CVP Brett Ostrum confirmed this to Windows Central in an interview on the sidelines of Snapdragon Summit 2026.

“These are not called Copilot+ PCs,” Ostrum said. “They do meet all the requirements of our previous bar for what Copilot+ devices are. We still lean into the narrative around AI on the edge and being able to have a hybrid out there.” Even other devices that would’ve been eligible under the branding, including the upcoming Nvidia RTX Spark N1X and Microsoft’s own Project Zenith, are missing the Copilot+ badges. The company also said that it’s scaling back Copilot’s presence in Windows 11, promising to improve the operating system’s performance, reliability, and updates. Microsoft also vowed to optimize it to run smoothly on just 8GB of RAM amid the AI-driven memory shortage.

However, that doesn’t mean Microsoft is backing away completely from Copilot. Despite dropping the hardware branding, it’s still working on numerous AI features for its product lineup. The company recently revamped Copilot and added new features like Home, Code, and Autopilot. It has also tested Copilot+ AI features that run on discrete GPUs, possibly expanding the feature set to PCs that use processors without a built-in NPU. In fact, one AI consultant mapped out Microsoft Copilot products and discovered more than 80 unique offerings, with many more possibly unaccounted for.

Microsoft did not give a specific reason for dropping the branding, but as many modern mainstream and high-end processors now come with NPUs that can hit 40 TOPS or more, it seems that it no longer makes sense to offer that differentiation. Aside from that, the current memory chip shortage has made the minimum 16GB requirement rather expensive, with Microsoft even purging its 32GB RAM recommendation from its website and releasing brand-new Surface for Business laptops with as little as 8GB of RAM.

It’s still unclear if the quiet sunset of the Copilot+ brand means that every Windows 11 PC will now get all the AI features that were once locked behind the name. But even if it will no longer exist on the hardware side, we still expect the Copilot branding to stay inside Windows and other Microsoft products for better or for worse.

Microsoft is taking another swing at Copilot, adding new features as it specifically turns the AI feature set into a series of tools designed for work. Branded "new Copilot", it will serve as a mix between a chat, a harness, and a business assistant.

Copilot will now be divided into three sections: Home, Code, and Autopilot. Microsoft pitches Home as a "new starting point," where you organize and connect your meetings, documents, emails, apps, and yes, agents. Effectively, it keeps everyone aligned on projects. The company describes the Home area as mixing Chat and Cowork, its existing agent. The new Copilot is rolling out with Microsoft's Frontier Program for businesses and individual subscribers, allowing early access to features now.

Office will live in the Home section, including Teams threads, calendars, Outlook, and more. You can ask Copilot to build slides, create spreadsheets, or put together documents.

Code is an answer to ChatGPT's Codex and Anthropic's Claude Code. Microsoft is describing the act of vibe coding and building small apps "as basic a skill as writing a memo or modeling a budget." Code is built on the same technology as GitHub Copilot, and is run in a sandboxed environment that can be hosted on your system. With Microsoft's new Copilot Managed Runtime, enterprises will be able to host code in their own Microsoft 365 environment, with Microsoft managing the code.

Autopilot is a rebranding of Scout, a "digital teammate." This is a semi-autonomous agent that you can name and tell what to do, and it will go off on its own to do it. This is designed for recurring work, though Microsoft describes it as being able to do more advanced work, including building schedules, handling meetings, and reaching out to others in an organization.

All of Copilot uses Microsoft IQ, designed to set a business context for agents to follow by giving them a framework about how AI should work in your organization. By the end of the month, Microsoft expects to launch a plugin registry to add functionality, in a catalog managed by IT administrators.

For managing spending, Microsoft's subscription license will give you Copilot in chat across Office, while an "Auto" mode will consider accuracy, speed, and cost to pick a model for other jobs. Organizations can use usage-based billing to pick which models they want to use based on cost. "Cowork, Code, and Autopilot; new long-running agentic capabilities; and frontier models like Astra and Fable all run on UBB," Microsoft chief marketing officer for AI at Work, Jared Spataro, wrote in a blog post.

Copilot may not be as exciting to individual developers and at-home enthusiasts as some other AI platforms, but it's clear Microsoft is revamping to take another shot at making its AI tools the most popular for businesses.

The DataOne data center in Vineland, New Jersey, has just been hit with a record $1.07 million fine for operating unpermitted portable generators on the construction site. According to the New York Times, state inspectors spotted 62 of these units powering the facility back in late July.

Residents had already complained about it at a February town hall meeting. Inspectors said that there were no generators on site when they first visited in December last year. However, some residents said that “some type of unit” was spotted by satellite imagery back in February, leading to their complaint at the community assembly.

Residents of Vineland have already made multiple complaints about the development. Some of the issues t include the unpermitted construction of a 1.5-million-gallon LNG tank and unacceptable noise levels, especially at night, that affected homes within a half-mile radius of the construction site. They also said that there was little to no public consultation on the project before it went into full swing, with the people only finding out that a data center was being constructed in their neighborhood after Microsoft announced a $33 billion deal with Nebius, which in turn contracted DataOne to supply the compute they need.

Despite a record fine, some residents feel that the punishment isn’t enough. “It’s a ‘don’t ask for permission, just ask for forgiveness later’ kind of deal,” longtime Vineland resident Steve Brown told the Times. He also added, “It’s still kind of a drop in the bucket for a company that has several billion dollars of capital.” Long-time community member Tiffany Leone-Vespa also added, “What’s $1.07 million? They should have done it for each generator they were running illegally. They’re billionaires. It’s like pocket change.”

On the other hand, DataOne disagreed with the fine. A company spokesperson said that “We will apply for the air permits for the temporary generators,” and also added that it’s transitioning from the polluting and noisy portable turbines to more modern fuel cells. New Jersey ordered it to comply with the permitting requirements and to stop using the generators if they’re not granted within 45 days.

This is a similar situation that the citizens of Memphis and Southaven faced when SpaceXAI deployed 69 unpermitted generators to provide power to its Colossus 2 data center. It has become the subject of a lawsuit, especially as the community raised concerns that they were spewing thousands of tons of pollutants in the primarily black neighborhood. However, the Department of Justice stepped in and asked the court to dismiss the case because the site “supports mission-critical operations.” Elon Musk’s company eventually agreed to remove all unpermitted turbines, but said that the process will take over a year as replacement 1.2-gigawatt plants gradually come online.

Microsoft is finally updating its lowest-end computers: the 13-inch Surface Laptop and 12-inch Surface Pro. Both systems are getting the Qualcomm Snapdragon X2 Plus processor (including an 80 TOPS NPU), up from a first-gen Snapdragon X Plus. The company announced the new Surfaces on its blog, in timing with Qualcomm's Snapdragon Summit.

Both new devices will launch on October 13. The Laptop will start at $1,199, while the Surface Pro will be $1,149. These are substantial increases over the previous versions, which started at $899 and $799, respectively, when they launched.

Microsoft claims that the new systems are 17% faster in Microsoft Office workloads, up to 18% more efficient on battery, offer "more than" 60% faster graphics, and have up to 95% faster AI inferencing on the NPU. Those are all compared to previous-generation Snapdragon X Plus processors.

Both systems are getting a new black color and 25% brighter displays than previous generations. The 12-inch Pro will also receive optional 5G connectivity, but only in enterprise versions of the device.

The Surface Pro will also introduce Ink Canvas, a new sketching and annotating app for Windows 11. It comes preinstalled on the new tablet and will be available for other Surface and supported Windows 11 devices through the Microsoft Store.

Surface Mouse

Beyond the two new Surface systems, the company is also announcing a new Surface Mouse. The $79.99 mouse includes haptic feedback, which has only been on some Surface notebooks so far. This can take advantage of features built into Windows 11 that allow for haptic responses for actions such as hovering over the exit button or resizing windows. Logitech's recently released MX Master 4 mouse also supports haptics.

Microsoft's pointer is designed for ambidextrous use (unlike the MX Master 4), connects over Bluetooth 6.0, uses two AAA batteries, and comes in both black and platinum colors. Like the laptops, it will launch on October 13.

More games are taking advantage of the free-to-play model, and Microsoft is building systems designed to deliver ads without disrupting the gaming experience. According to Respawn First, the system would first give players some ad-free playtime, which could either be based on time or in-game progress, such as levels and bosses. Once this expires, the company will then open a window and briefly serve “promoted content.”

However, this system will not just show ads out of the blue. Instead, it will work with the game engine so that they will only appear during downtimes, like after a boss fight, at the end of a cutscene, while a new level is loading, when you complete a quest, or enter a menu. While the ad is being served, the game enters a frozen state to ensure that player progress isn’t disturbed. After you finish watching the ad, it resets the ad-free playtime, allowing gamers to play another round with no distractions.

The patent application itself describes it as “a content management system” and that it could obtain a promoted content trigger event based partially on the game, suspend a user’s interaction with the game based on the promoted content trigger event, obtain promoted audiovisual content and present it to the user, commence the user’s interaction with the game, and establish “a credit based at partially on the promoted audiovisual content, wherein the credit delays suspension of the user’s interaction with the interactive software application during a credit duration.”

Based on this description, it works similarly to some free-to-play mobile games, where ads are automatically served after you finish a round or after a few minutes of playing. The difference with this system is that it doesn’t serve ads arbitrarily; instead, it works with the game engine and even uses machine learning to determine when it’s the best time to show players the ad.

While this is still a patent application and it’s not even clear if this has been deployed in actual games, it shows what Microsoft is considering for how it could monetize free-to-play games. We’ve seen similar moves with Xbox Cloud Gaming, with the company experimenting with an ad-supported free tier for the cloud gaming service.

While the tech that Microsoft applied for a patent on could actually be a good thing, as it would make in-game ads less jarring, we could argue that it would encourage both gamers and publishers to focus on free-to-play titles. The idea behind these games and services is that it would allow more people, especially those who don’t want to spend cash, to enjoy gaming. However, some say that they’ve actually broken the diversity and innovation in the gaming industry, as developers and publishers focus more on monetization instead of unique games and quality titles. You can view the USPTO application here [PDF].

The New York Times sued OpenAI and Microsoft for copyright infringement in late 2023, with the case apparently still ongoing almost three years later. Now, the publication’s legal team has asked the court for a summary judgment after it filed a revealing legal brief based on statements and documents from the defendants. According to 404 Media, these documents remain sealed or redacted at the request of both companies, with the revelations showing potentially damaging statements from their leadership, including claims AI scraping is the biggest theft of labor in human history and an existential threat to publishers.

The brief cited an internal memo dated January 2023 by Microsoft director of Applied Science Brent Hecht, where he allegedly said, “Millions of people around the world will soon consider large models ‘hoovering up’ all their work to be an astonishing theft of unprecedented proportions” and also called it “the largest theft of labor in human history.” Another Microsoft document was cited saying, “almost no one intended for content they created to be used in this fashion, nor are they compensated for its use.”

As ChatGPT surged in popularity throughout 2023, the software giant’s own data revealed that Copilot dropped click-through rates for The New York Times by as much as 93% compared to Bing search. Another memo by the Applied Science director called it a “doom loop” and said it would “hurt the performance of our models and the entire web at the same time.” The NYT brief quoted Hecht from the document, saying, “It is highly unusual that an end-product threatens the economic foundations of its essential suppliers, but that is the situation we have created for our LLM business with respect to its ‘content supply chain.’”

OpenAI Head of ChatGPT Nick Turley said in internal communications that the AI chatbot is an “existential threat” to publishers as they are “largely substitutive” and “will get more and more substitutive as they get better,” while another OpenAI engineer testified that “no matter how prominently we show the links, users won’t click.” Nick Ryder, another OpenAI researcher, told company president Greg Brockman about a “hack to get around nytimes paywall,” to which he replied, “ah nice.”

AI companies argue that scraping the internet for data to feed to their models is “fair use,” with one court agreeing that Anthropic’s use of published material falls under this category. The law defines this as “criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research.” Some of the factors that determine whether a particular use falls under “fair use” include “(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and (4) the effect of the use upon the potential market for or value of the copyrighted work.”

However, all these revelations in NYT’s brief could complicate OpenAI’s fair use defense, especially as it shows that the leadership of both companies are aware of the possible market repercussions of AI scraping. Microsoft CEO Satya Nadella said in a deposition from earlier this year that “anything that is paywalled should be licensed by anyone who wants to use it…for grounding or training” and that if he “had been made aware that OpenAI has scraped and trained on information that was behind a paywall,” the company would have required OpenAI “to retrain its models.”

Anyone old enough to be messing with PCs in the early to mid-2000s probably has the following burned into their mind: FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8. That's neither a magic spell nor a password for a cabal — it's the best-known Windows XP key, letting anyone install and run the operating system with its incantation and just the one CD. Ever wondered how or why Microsoft let such an apparent gaping hole in its copy protection? Former engineer Dave Plummer explained in an X post.

First off, there were actually two versions of the original Windows XP media: Retail and Volume. The former was for anyone who just bought the OS off the shelf, while the latter was reserved for Microsoft partners and OEMs that needed to easily install it on thousands of machines without needing to individually activate every single one at install time.

Retail and Volume media had different keys, too, and the installer would validate the key you input against specific data on the disc, "encrypted so hard that even today it hasn't been decrypted [...]" (Someone will take those words as a challenge). The magical piece of cryptic data was nothing other than the whole 10 MB of... Microsoft Bob. The short-lived assistant was technically the antecessor of the much-maligned and memed-upon Clippy, and did its best in 1995 to introduce newbies to basic computing tasks.

Regular Joes and Janes weren't supposed to be anywhere within a stone's throw of a Volume disc, though, as those were strictly enterprise-only. The final version of the CD, called Release to Manufacturing, or RTM, was complete in August 24, 2001 — two months before the official launch on October 25. The discs were available to OEMs and partners before the release date so those companies could have their wares ready with Windows XP on them.

Plummer notes that "very few" organizations had access to the Volume image and the corresponding Volume License Key (VLK) and believes that someone at a major OEM, potentially Dell or Intel, leaked the Volume media and the key together before the official release. The pirate group Devils0wn then quickly spread it online for everyone to enjoy

Later on, when Service Pack 1 arrived, the FCKGW key was among the 640 blacklisted from the operating system due to leakage. Service Pack 2 and its Windows Genuine Advantage checks went a couple steps further and blocked updates entirely on machines with a blacklisted VLK. Plummer states that Microsoft didn't want to cause unnecessary trouble for customers, hence its laissez-faire attitude and choice to stick to just blacklisting affected keys.

Many theories over the years proposed that the FCKGW key worked because Microsoft's key generation algorithm was very basic, a notion outright dismissed by Plummer. He plainly states that algorithm was written by "ACTUALLY smart guys with heads so big that they bumped the doorjamb on the way into your office."

The truth of the situation was far simpler: as is usual with computing, ultimately the problem was between the keyboard and the chair. It's a good a time as any to reminisce about that compact disc you totally don't have on a bookshelf somewhere with the FCKGW key written on it with a Sharpie.

Microsoft has issued an out-of-band update for its recent Windows 11 patch, which has caused a number of bugs and issues. The September 2026 update was just released last Tuesday, and although it packs a number of new features and fixes nearly 1000 security flaws (commonplace in this day and age), there are also a few unfortunate regressions.

The 25H2 update finally reintroduces a movable taskbar, just like we've had since Windows 95, with an option to make the height smaller for compact displays. Likewise, the Start menu now has multiple configurable layouts, and you can toggle each main section on or off. Microsoft also revamped Windows Search — perhaps to finally be useful — and users can now choose to only have it display local results. Explorer got a handy tweak in the form of using KB, MB, GB size indicators, as well.

The update has also surfaced some serious bugs. First off, PCs with AMD Radeon GPUs are crashing, apparently due to the update provoking driver instability. Reinstalling the driver doesn't appear to help, and the reports unfortunately cover most contemporary AMD graphics cards. Microsoft did not mention AMD GPUs specifically in its latest update.

Microsoft noted that it has fixed an issue with Remote Desktop Services where RDS might become unstable, causing connection and sign-in failures.

Microsoft is also aware of an issue with audio output and microphone input going dead. Additionally, there are seemingly reports of audio devices starting up with a botched configuration, like tweaked 3D audio settings or speaker setups. The apparent workaround seems to be putting audio in a standard 2.0 configuration, but Microsoft has now addressed this issue in the emergency patch.

Explorer may display a black screen after logging in, leaving you with a perfectly functioning operating system but no visible UI. The File History backup feature is reportedly not detecting external drives, effectively making it useless. Of particular concern to enterprises, systems administrators, and homelabs, the Remote Desktop Service is also experiencing issues. Last but not least, Microsoft says it has addressed an issue where Claude Cowork is nonfunctional due to the update breaking HC-managed Linux VMs with Plan9 shared folders

Owners of HP and Lenovo systems are also advised to consider holding off on this update. Ever since the August 2026 patch (and now, cumulatively, with the September update), there are reportedly serious issues on both camps. On the HP side, there are instances of the update triggering BIOS corruption, leading to a failed install with no ability to recover the OS — though seemingly the OEM has published a new BIOS revision, so it's hard to say which side is to blame. Meanwhile, Lenovo users might have their machines black-screen or shut down out of the blue, seemingly due to power mismanagement.

While it's heartening to see that Microsoft has significantly increased its Windows development speed and is seemingly listening to customer feedback, a string of bugs after a major feature update are still common.

Residents of Frederick County, Maryland, could be the beneficiaries of what is purported to be the biggest residential benefits package yet to be offered by data center developers, in a move a new report claims is a sign of a growing trend that Big Tech is trying to get ahead of fears and community pushback surrounding AI infrastructure. The $110 million deal includes new schools, water reclamation, and more, The Information reports.

According to the report, the Frederick Digital Campus offering could be a sign that data center developers like Amazon, Microsoft, and Oracle are wising up to growing residential pushback and concerns around the building of large AI data centers in their communities, with developers "sweetening financial offers to municipalities and regulators to gain approval for new facilities" while "getting smarter" about ensuring they shoulder the cost of utilities like electricity. The report says AI builders are turning towards tangible benefits, rather than rhetoric, to get their projects approved.

The Maryland site, if approved, would see residents of Frederick County benefit from a $110 million investment in total, including a $30 million elementary school, $40 million of recreational facilities, a $14.5 million workforce training center, and a further $10.5 million for "agricultural preservation." That comes on top of a purported $215 million in annual property taxes the campus would pay upon completion, a 40% uptick in tax revenue.

It appears the developers have also offered concessions regarding construction, reducing the square footage by almost 20%, and reducing potable water (water safe for human consumption and use) usage by 80%, with up to $100 million also proposed for a water reclamation system.

The proposal is yet to be approved, but if passed, the campus would boast Amazon and Aligned Data centers amongst its tenants. The report reiterates the deal "reflects a rapidly emerging consensus by both tech companies and host governments to eliminate giveaways to developers and to accelerate benefits to towns in the vicinity of the facilities."

A further cited example from Pennsylvania claims AWS announced it would not seek any economic incentives to reduce the tax burden on its 4.5GW, 36-building data center campus in Homer City.

The report further cites occasions where big tech companies are taking the side of consumers and residents over power rate debates, with Microsoft recently said to have challenged an American Transmission Co. and We Energies’ proposal for its Wisconsin data center, claiming the plan wasn't robust enough to protect retail customers from footing the bill if demand was lower than expected. In another case, Google and Amazon are said to have lobbied Virginia regulators to ensure they would fund transmission upgrades required for their infrastructure, rather than let an energy company cover the cost by marking up customer bills.

With concerns around data center buildouts impacting local water supplies, energy rates, and even contributing to noise pollution, it's clear that Big Tech companies appear to be trying to grease the wheels on a local level by investing more directly in some local communities. Big Tech has reportedly now spent more than $1 trillion on AI infrastructure, so even local investments to the tune of hundreds of millions of dollars are a drop in the ocean for companies.

Regulators are trying to pump the brakes on data center buildouts, with some 500 data centers on hold in the US because of various moratoriums and legal pauses.

Microsoft has finally solved one of the biggest pain points of Windows with the rollout of Cloud Rebuild. The new recovery feature can reinstall Windows 11 even when an existing Windows installation is corrupt or refuses to boot. Available as a beta through the newly released Windows 11 Insider Beta Preview Build 26220.9343, the feature is essentially a hassle-free alternative to creating a Windows installation USB drive when a PC needs to be recovered.

According to Microsoft, Cloud Rebuild is designed to restore a Windows 11 PC to a “clean, known-good state” by downloading a fresh image of Windows along with the required drivers directly through Windows Update. Unlike the existing Reset this PC functionality, it does not depend on the health of your existing Windows installation, nor does it require users to have a USB drive or custom recovery image available.

Available via the Windows Recovery Environment (WinRE), users can access it by selecting Troubleshoot > Recovery and uninstall > Cloud rebuild from WinRE. Speaking of which, Microsoft has also improved networking support in WinRE. The recovery environment can now reuse eligible Wi-Fi profiles saved within an existing Windows installation, allowing a PC to connect during recovery without requiring administrators to separately configure Wi-Fi credentials in WinRE. Once the PC is connected, Cloud Rebuild checks Windows Update for the target Windows build and downloads the required files. Users can then confirm the Windows edition, language, and build before starting the reinstall.

The only catch here is that Cloud Rebuild completely wipes the system drive, meaning that the process removes all data stored in your main installation or C: drive, including locally stored files, accounts, applications, and settings, before reinstalling Windows. Thus, it is recommended to back up all your important files either locally or using a cloud-based service before starting the process. Once the installation is complete, the PC boots into the Windows out-of-box experience, similar to a fresh installation of Windows. For admin-managed PCs using Windows Autopilot and Microsoft Intune, the system can automatically reconnect to the organization's management infrastructure and restore assigned applications, policies, and backed-up settings.

Cloud Rebuild could particularly be useful when Windows becomes too corrupted to boot normally. Instead of finding another PC, creating installation media, and manually reinstalling Windows, users can potentially perform the entire recovery process directly from WinRE. The feature is still in preview; however, we can expect a wider release later this year.

Microsoft just released another version of Windows 11 designed for developers, dubbed Project Zenith. According to the Windows Blogs, this operating system is optimized for developer workflows and will first become available on the AMD Ryzen AI Halo, Team Red’s direct answer to the Nvidia DGX Spark, although it will also arrive on more devices from Microsoft’s OEM and other silicon partners soon. Redmond calls Project Zenith “a ready-to-code distraction-free Windows experience on developer-class devices with 64 GB+ unified memory and 250+ GB/s memory bandwidth,” claiming that “developers can jump right in.”

It comes with pre-installed tools like Visual Studio Code, GitHub Copilot, PowerToys, WinAppCLI, Windows Dev Skills, Intelligent Terminal, PowerShell 7, Git, GitHub CLI, AzureCLI, Core Utils, Oh My Posh, Python 3.14+, uv, NVM, Node 24+, WSL 2+ Ubuntu, and .NET 10. Aside from that, Microsoft said it pre-configures Windows 11 so developers don’t have to dig through the settings menus of various apps to configure them for their needs.

It’s primarily designed for AI developers, especially since the devices it’s installed on are designed to run 30B+ parameter models locally and without meters. The company also made it more secure for developing and running agents, deploying features such as OS-enforced identity, containment through Microsoft Execution Containers (MXC), and enterprise-grade manageability for agents.

Project Zenith is Microsoft’s response to the AI token crisis, which has caused costs to spiral out of control, especially as agents use 1000x more tokens compared to standard AI. While frontier models would still be available on the cloud, AI developers could run everything else locally through devices like this, powered by this version of Windows 11. This should help AI developers keep using their agents without feeling the bite of tokenized billing, which is especially crucial for those working in smaller organizations or experimenting at home.

One big tradeoff with Project Zenith, though, is that it’s only available on expensive devices, at least for the moment. The AMD Ryzen AI Halo, with its AMD Ryzen AI Max+ 395 processor, 128GB LPDDR5x-8000 RAM, 2TB SSD, and integrated Radeon 8060S graphics, costs $3,999.99 on Micro Center. Even if Microsoft eventually makes Project Zenith available for separate purchase and installable on other mini-PCs, the 64 GB+ unified memory requirement will be a major roadblock, especially with skyrocketing RAM prices driven by the AI boom.

Microsoft will begin automatically enabling its Memory Integrity security feature on a broader range of eligible Windows PCs through quality updates starting in October 2026, extending the kernel-level protection to more existing devices by default. In a September 1 blog post, Microsoft said the rollout will provide stronger protection for more devices against attacks targeting the Windows kernel, while PCs that already have Memory Integrity deliberately disabled will retain their existing configuration.

“Windows quality updates will begin enabling memory integrity protection on eligible devices,” Microsoft said. The updates will also enable Virtualization-based Security (VBS) where required, which provides the isolated environment underlying Memory Integrity. Before making the change, Windows will automatically assess each device using what Microsoft describes as readiness signals covering its hardware capabilities, compatibility, and performance.

The October rollout is basically an expansion of Microsoft’s existing default-enablement policy. Memory Integrity is already switched on by default on clean Windows 11 installations that meet Microsoft’s hardware requirements, as well as on Secured-core PCs. Current requirements include an 8th Gen or newer Intel processor for Windows 11 22H2, an AMD Zen 2 or newer processor, at least 8GB of RAM on x64 systems, an SSD of at least 64GB, compatible drivers, and enabled hardware virtualization. Automatic activation under that policy applies to clean installations and not upgrades of existing devices.

Memory Integrity — also known as Hypervisor-Protected Code Integrity (HVCI) — has existed since the Windows 10 era and was originally released as part of Microsoft’s Device Guard security technology. It uses VBS and the Windows hypervisor to move kernel-mode code-integrity checks into an isolated environment, helping prevent malicious or untrusted code and drivers from executing in the Windows kernel. Windows 10 generally left the protection optional outside configurations such as S mode, while Windows 11 made it more of a default security feature on compatible new installations.

The feature comes with a performance wrinkle familiar to PC gamers, leading many gamers to disable it. Microsoft acknowledged in 2022 that Memory Integrity and Virtual Machine Platform could affect gaming performance on some Windows 11 configurations, and advised gamers prioritizing performance that they could temporarily disable these protections while playing, warning that doing so reduces security. The company’s own gaming guidance subsequently continued to recommend temporarily disabling Memory Integrity and VMP where they interfere with gaming performance.

The security feature’s impact on performance depends on the hardware. Microsoft says Memory Integrity performs better on newer processors with hardware features designed to accelerate the required isolation, while older CPUs relying on software emulation can experience a larger performance hit. Driver compatibility can also prevent activation, with Microsoft documenting issues ranging from malfunctioning software to incompatible gaming anti-cheat solutions.

For most users, the October change requires no action. Eligible PCs will be evaluated and updated automatically, while administrator policies and previous user choices remain in place. Microsoft specifically says systems where Memory Integrity has already been disabled “won’t be automatically changed by this rollout,” leaving gamers and other users who previously opted out in control of the setting.

The DataOne data center in Vineland, New Jersey, has faced a slew of complaints from the community since construction began in 2025. According to Stand.earth, the project has reportedly been operating several unpermitted gas turbines on site, spewing air pollution in the area near two local schools. Aside from that, the site has also faced allegations of constructing an unpermitted 1.5-million-gallon liquefied natural gas storage tank and of unacceptable noise levels at night, which affected residents within a half-mile radius of the data center.

Matt Williams, chairperson of the Sustain South Jersey group, told Tom’s Hardware that construction had already begun even before Nebius signed a multi-year agreement to “deliver dedicated capacity to Microsoft from its new data center in Vineland, New Jersey,” in October 2025. However, the residents only became aware that the project was a data center after the $19.4 billion deal to secure around 100,000 Nvidia GB300 GPUs for the tech giant was made public.

Vineland residents began seeing references to the data center in various government documents, prompting several questions to the city government. Because of this, the city called a town hall meeting last January 2026 — several months after construction on the data center had already begun, with DataOne CEO Charles-Antoine Beyney admitting that the meeting should have been initiated several months before.

A few weeks before the town hall, some people living within a half-mile radius of the site started complaining about noise from the development. While they couldn’t confirm the source of the noise, it was often described as a low hum, similar to that of a generator. A later investigation revealed that the site had 62 gas turbines deployed in the area, with at least 45 running at any given time. This is similar to what SpaceXAI has done in Memphis, Tennessee, where it deployed 69 unpermitted natural gas turbines to power its data centers. While the company has since promised to remove these polluting generators, it will do so only over a span of one year, as they’re being slowly replaced by a 1.2-GW on-site power plant.

There have also been concerns that the site’s stormwater management system does not comply with the state’s regulations. A third-party engineering review stated that if these issues are not fixed, they could result in on-site and off-site flooding, especially given the site’s massive 55-acre size. The experts also noted that the data center has “underestimated the annual groundwater recharge by at least 20 million gallons per year,” which could result in lower aquifer levels and reduce the amount of water available or the water quality for the people living in the area.

“The incident should shatter the illusion that Microsoft is a ‘good neighbor’ or in any way more responsible than the other Big Tech companies,” Stand.earth Senior Campaigner Nathan Taft said in the statement. “This investigation has revealed that far from ‘doing this work differently than other’ as it promised, Microsoft is drawing directly from Elon Musk’s xAI playbook of doing the damage first and asking for permission later.”

In an interview with Tom’s Hardware, Nathan said that even though Microsoft does not directly own or operate the Vineland data center, it stands to reason that the tech giant should do something about all these complaints, as it’s the one that has contracted Nebius for the computing power, which resulted in DataOne’s construction project. He compared this to a contractor making a mess on their client’s neighbor’s property. Even though a third-party provider — DataOne — was at fault for the issue, the fact that the people have already been complaining should give Nebius pause and compel Microsoft to do something.

DataOne’s actions in New Jersey directly contradict the promise Microsoft made back in January 2026, and residents are asking the tech giant to stand by its word. Although the concerns about air and noise pollution are technically not mentioned in the company’s “community-friendly” commitments, these issues still impact the quality of life of the people living around the DataOne data center. Aside from that, the unpermitted construction shows it does not adhere to the rules of Vineland. “The developers have been ‘act first, pay the fine, and ask for forgiveness later,’” says Mr. Williams.

Developer Xusheng Li has uncovered some previously unknown functionality deep within Microsoft’s Paint and Photos apps. The findings concern GUID watermarks. While these programs clearly add Copilot logo watermarks to images where LLM image generation has played a part in the process, Li also uncovered an invisible watermark and the process behind embedding it. To be clear, both these watermarks are merely to identify/verify imagery where AI has had a role in the creation, so GUID should not be confused with the recent controversies over Microsoft’s GDID traceable device-specific telemetry.

Li says that simple curiosity spurred him to investigate the AI features of the Paint app in Windows 11. The image generation functionality being capable of calling a remote API was expected. However, the dev got more curious when four apparent model files were found in the app path for local processing. Specifically, one of the local files was an ONNX-like model, the other 3 were encrypted ONNX-like files…

With all four files unencrypted and open to probing, investigations led to watermarker.dll being uncovered. Initially, Li thought it was just for visible watermarking tooling, leaving a Copilot logo on the bottom right of the image. It calls the AddPerceptibleWatermark function to do this. However, with curiosity stoked by the DLL file’s larger-than-expected size, the dev decided to ask AI to analyze the file. The AI found there was also a function to embed an invisible watermark.

The invisible watermarking function is called WmkWriteWatermark. Microsoft’s embedding process basically insists on this invisible watermark in its Stable Diffusion image generation output. If WmkWriteWatermark fails for any reason, the generation process will result in an error.

Coalition for Content Provenance and Authenticity (C2PA) credentials

Li provides some further technical insight into the hidden watermark. Most strikingly, he asserts that the watermarking information mixes a server-issued GUID into the pixels. That isn’t the end of the identifying data bundling. “Paint does more than alter the pixels,” notes the dev. “It also attaches C2PA Content Credentials to the saved file. The code responsible for this lives in ProvenanceHelper.dll, backed by provenancesdk.dll.”

In conclusion, even on devices where local image generation occurs, the prompt is still sent to Microsoft servers for moderation, says Li. Moreover, the dev indicates this watermarking is mandatory, and if the process fails, Paint will abort the entire image generation process. In Photos, there is the same GUID mechanism in place when AI is used, but it will still return the image and just log an error if the watermarking process has issues.

It is thought that all this hidden processing “might be related to Article 50 of the EU AI Act, whose transparency rules took effect on August 2, 2026, and require AI-generated content to carry a detectable, machine-readable mark—but not a prompt-specific GUID.”

China's Ministry of State Security has told some state-linked organizations to remove a customized version of Windows 10 from their machines, Bloomberg reports, citing people familiar with the matter. The order reportedly accelerates a planned retirement that the software's developer had scheduled for February 2027, and it sent Chinese OS vendors' shares surging, with Hunan Kylinsec and Archermind both hitting Shanghai's 20% daily limit and China National Software climbing 10%. Bloomberg's sources attributed the directive to data security concerns but didn't specify what vulnerabilities Beijing is worried about.

The affected software is the government edition developed by C&M Information Technologies (CMIT), a joint venture set up in 2016 between Microsoft and state-owned China Electronics Technology Group, with the Chinese side holding the majority stake. The build is based on Windows 10 Enterprise but strips out OneDrive and other consumer-facing components, disables certain native functions, keeps updates and activation inside China, and lets government users substitute Chinese encryption algorithms for Microsoft's standard cryptography. China Customs and Shanghai's Commission of Economy and Informatization were among the first pilot customers when the edition launched in 2017.

Microsoft ended mainstream Windows 10 support globally in October 2025, which left CMIT's edition as the only Windows still officially sanctioned for Chinese government use. "Microsoft is not aware of a security incident affecting this product," a company spokesperson told Bloomberg, adding that it continues to receive regular security updates.

Beijing banned Windows 8 from government procurement in 2014, ordered a three-year replacement of foreign PCs in government offices starting in 2019, and in 2022 told central agencies and state firms to scrap foreign-branded computers entirely. The domestic stack built to absorb that demand now includes Kylin V10, UnionTech's UOS, and Huawei's HarmonyOS 5 laptops, and it reaches down to the silicon in systems like Huawei's Qingyun desktops running the homegrown Kirin 9000X.

StatCounter's traffic data shows how little of that campaign has reached the consumer market. Windows accounted for 87.64% of Chinese desktop web traffic in July 2026, and Windows 10 alone still made up 43.56% of Chinese Windows usage, compared with 50.01% for Windows 11, ten months after mainstream support ended. Roughly two in five Chinese desktops are currently running an unsupported Microsoft OS, the gap that CMIT's edition was meant to close for government users.

It's not clear what the scope of the new directive is, with Bloomberg's reporting covering “some” state-linked entities. CMIT didn't respond to the outlet's request for comment.

Apple used to be among a few companies willing to buy memory and other components worth billions of dollars under long-term supply contracts at fixed prices. But the artificial intelligence era represents a new reality with new purchasing champions, marking a tectonic shift in the high-tech world. Alphabet, Microsoft, Meta, and Amazon have purchase commitments totaling about $2 trillion, and a significant portion of these commitments are for memory, according to estimates by analyst Claus Aasholm. While the commitments are approximate, span many years, and should be generally taken with a grain of salt, they still reflect the direction the industry is moving.

Combined purchasing commitments from the four major hyperscalers shown in the chart —Amazon, Alphabet, Meta, and Microsoft — reached nearly $2 trillion by Q2 2026, with Alphabet and Microsoft accounting for the overwhelming majority of the total.

The rapid expansion suggests several major findings. Firstly, the AI infrastructure race is accelerating, not stabilizing. Secondly, AI infrastructure investments are driven by a handful of hyperscale cloud service providers (CSPs) whose long-term procurement commitments now vastly exceed those of traditional consumer electronics companies such as Apple.

Thirdly, memory has become a strategic asset — perhaps a competition weapon — rather than a commodity. Fourthly, suppliers of memory — both 3D NAND and DRAM — are gaining pricing power. Finally, demand for memory will likely drive major capacity expansion at Micron, Samsung, and SK hynix, even though so far these companies have been exceptionally disciplined about their capacity investments.

Almost $2 trillion commitments

Google shows by far the most aggressive increase in purchasing commitments, rising from roughly $140 – $150 billion in Q3 2025 to around $811 billion by Q2 2026 (though these are total purchase commitments by Alphabet, not specifically memory purchase commitments), while Microsoft follows a similar trajectory and reaches approximately $678 billion in total obligations, which includes, but is not limited to memory.

Meta is also ramping commitments substantially to around $349.3 billion (again, these are total commitments), whereas Amazon increased its commitments more gradually to roughly $130 billion. By contrast, Apple — which makes the world's most popular smartphone, and which was the largest consumer of memory just a couple of years ago — remains almost flat throughout the period at approximately $57 billion (of which $56.2 billion is payable within 12 months). Apple's commitments fall well short of Nvidia's commitments of $119 billion.

Again, we are talking about total purchase commitments, which include foundry capacity, 3D NAND, and DRAM memory, but are not limited to them. Alphabet, Amazon, Meta, and Microsoft all build custom silicon and custom servers, so a significant portion of these commitments is to various EMS providers.

While $1.968 trillion of purchase commitments for memory and storage alone would be an absurdly large amount of money, a huge portion of these commitments consists of contract manufacturing obligations as well as memory chips. This suggests that the foundry, 3D NAND, and DRAM markets are entering a new phase in which hyperscalers are willing to make vastly larger forward purchasing commitments than traditional consumer-electronics companies, giving suppliers a strong incentive to prioritize customers prepared to secure future capacity on that scale.

Strategic assets

While Claus Aasholm's chart is explicitly dedicated to memory, it does describe total purchase commitments of tech giants, so the chart can reasonably be read as evidence that memory and capacity at TSMC, Samsung Foundry, and GlobalFoundries are becoming a strategic asset rather than merely another component to procure at the best available price.

AI infrastructure requires enormous quantities of AI accelerators, DRAM (including HBM), and 3D NAND. Meanwhile, the supply of high-end memory (HBM) is constrained by fab capacity at major DRAM makers, whereas the supply of AI accelerators is constrained by both wafer capacity and foundries and packaging capacity at foundries and their OSAT partners. As a result, hyperscaler CSPs have an incentive to lock in supply years ahead, even if doing so requires exceptionally large purchasing commitments.

That also changes the relationship between semiconductor suppliers and their customers. In theory, a company willing to guarantee hundreds of billions of dollars of future purchases can effectively help underwrite expansions of foundry, memory, and advanced packaging capacity and, in return, secure priority access to scarce products and future process technologies. In reality, TSMC can well afford capacity expansion using the money it gets from hyperscalers and give priority to its largest customers. In this environment, access to DDR5, HBM, and 3D NAND memory becomes part of the competitive advantage rather than merely a procurement exercise.

This is also what makes Apple's position in the graph interesting: its purchasing commitments barely move while those of Alphabet, Amazon, Meta, and Microsoft surge. If the trend continues, Apple may remain one of the world's largest semiconductor buyers in absolute terms, but the question is whether it will be among the key customers that foundries, memory makers, and OSATs plan their future capacity expansions.

An inflection point

Perhaps the most interesting takeaway of the findings revealed by long-term purchase commitments is that the industry's center of gravity appears to have shifted.

During the smartphone era, foundries (well, TSMC has won) and memory suppliers often competed aggressively for Apple's business because of its enormous purchasing power. Today, hyperscalers building AI infrastructure are making purchasing commitments that dwarf those of traditional CE companies like Apple, which may well represent a strategic inflection point akin to the one Andy Grove described in his 'Only the Paranoid Survive' book.

Will this tectonic shift result in prioritization of customers capable of enabling future capacity expansions through massive long-term purchase agreements, or will foundries and memory makers remain more or less disciplined with their capacity expansions so as not to lose a lot when demand declines? This is a question that has yet to be asked.

In any case, the AI megatrend has transformed semiconductors — from foundries to advanced packaging and from DDR5 to HBM4 — into strategic assets that can no longer be treated as ordinary components procured on demand. And this is something that will continue in the long run.

A developer has ported Microsoft Word for Windows 1.1a to x64 so it can now run natively on Windows 11 PC systems. JMarshall23 on GitHub stresses that this is a fully working native Windows x64 port using “original Word source and resources together with modern replacements for the 16-bit assembly, segmented-memory, and Win16 platform boundaries.” It also includes some extra features for “research purposes.” Microsoft Word for Windows 1.1a was originally released over a quarter of a century ago.

This release of Word marked a milestone in the word processing market, as it pioneered genuinely useful feature additions like WYSIWYG editing, graphics, and table insertion on Windows. It would spearhead the momentum in shifting users from DOS productivity monsters like WordPerfect to complete dominance in Windows-land. Word for Windows 1.1a added all its frills while remaining very efficient, running on systems with CPUs that ran in single-figure MHz speeds, and with as little as 1MB of RAM.

Another notable feature of this version of Word for Windows is that Microsoft permitted its source code to be released in full. You can still grab that code via the Computer History Museum (CHM). There you will find a 7MB bundle of C source, x86 assembly, build tools, and documentation. These 1,021 files in 33 folders are what JMarshall23 started with.

GitHub doesn’t have Windows x64 binaries ready for the casually curious on the lookout for a free, lightweight word processor to download and use. Instead, you’ll need access to Visual Studio 2022 with Desktop development with C++, a Windows 10 or Windows 11 SDK installed through Visual Studio, CMake 3.25 or newer, and PowerShell, notes Marshall. Then simply follow the GitHub instructions to build and run Word1.

It will be interesting to see if more comes from this x64 port, but Microsoft’s Word for Windows 1.1a code release carries a license that “permits only non-commercial use and does not give you the right to license it to third parties by posting copies elsewhere on the web,” says the CHM.

Xbox price increases across the UK and Europe have been revealed, reports the Video Games Chronicle. Promotional graphics for these markets show that Microsoft is stoking prices up as much as £170 or €200, depending on the model buyers are interested in. The confirmation comes a little more than a week after it was revealed that U.S. customers were going to be facing Xbox price increases by as high as $150 from August 1.

The unquenchable thirst of AI data centers for computing hardware has precipitated the unusual sight of consoles actually getting more expensive as their life cycle extends. Now we are seeing consoles priced as much as $300 more than when they originally launched in 2020. Yes, this latest price rise isn’t the first.

The worst hit are those looking for the most capable SKUs. Specifically, all the big numbers we’ve used to illustrate the scale of these rises reference the Xbox Series X (1TB, Disc) pricing. This device now costs $799 in the U.S., £669 in the UK, and €799 in Europe. Check the table below for the full range of SKUs and new prices.

It looks like those in European markets will be hardest hit, as a €200 increase converts to an approximate $230 increase. Remember that UK and European prices for consumer goods will always include all sales taxes, though.

In our recent story about the Xbox price hikes (in the U.S.), we noted that the 2TB console was also killed off by Microsoft.

Readers won’t be surprised that this latest set of hikes is another symptom of the AI boom and RAMpocalypse. The pricing of essential components used by servers, computers, smart devices, and consoles alike has all skyrocketed over the last year, led by RAM and SSDs.

Sony increased all its PlayStation 5 prices in April, with every SKU going up by $100. Perhaps it will have to revise things upwards again, shortly. Meanwhile, PC buyers are also glum with the rapidly increasing prices of components and pre-built console-killers like the Steam Deck and Steam Machine, all seeing significant price increases.

Another day another Doom port, but the new DoomPaint stands out from the crowd for a few reasons. Firstly, it has been developed by Mark Russinovich, the Microsoft Azure CTO. Secondly, DoomPaint runs the actual original shareware Doom release using MS Paint as the monitor or viewport for in-game action. That’s different, and it is remarkable to read that the OLE clipboard hack behind this latest Doom escapade allows the game to run at a fair pace, up to 35 FPS, but might also sometimes be “spreadsheet-tier,” according to the author.

“The actual Doom engine (ViZDoom) runs the real shareware DOOM1.WAD — with the BSD-licensed Freedoom WADs covering the episodes shareware doesn't ship — and renders headlessly,” explains Russinovich on the project GitHub page. “Every frame is placed on the Windows clipboard and pasted into Paint's canvas as a genuine document edit.” The Microsoft CTO adds that the relatively low frame rate “is part of the charm” of DoomPaint, but 35 FPS isn’t bad, if you can make it, especially in 1990s PC gaming terms.

There are files, resources and instructions on how to run DoomPaint on the GitHub site. Depending on your machine you may be able to run this version of Doom at a full 35 FPS at 320 x 200, or even 640 x 400 pixels. It even includes sound and music.

Towards the end of the README file, Russinovich says that “Paint renders the game but does not compute it. Paint computes nothing. Paint has never computed anything. That's the joke.” DoomPaint is distributed under the MIT license.

Russinovich started at Microsoft in 2006, where he’s transformed SysInternals into the backbone of Windows diagnostics. More recently he’s shaped Azure’s architecture, security, and reliability. Over the past year he has, accidentally or by design, become well known as a leading voice behind addressing the many shortcomings of Windows 11.

It's therefore kind of surprising that this busy CTO has time to fiddle with projects like DoomPaint. However, the most dedicated coding and computer enthusiasts will also code and compute in their spare time.

Amazon, Google, Meta, and Microsoft have spent more than a trillion dollars on AI infrastructure, including data centers, the chips inside them, and the power needed to run the facilities, since 2023. The Financial Times said that these four big companies have already hit $1.1 trillion in capital expenditure based on their latest earnings reports, and that an additional $745 billion is expected to be added to this figure just this year.

“There is basically no end in sight for the growth in capex,” RBC Capital analyst Rishi Jaluria told the publication. “Investors need these companies to toe the tight line between investing in AI and not compromising the things that have made them successful.” This massive investment has upended several other industries — namely electricity prices and memory and storage chips. The massive power demand that data centers have put on the power grid has forced many U.S. utility companies to spend billions of dollars to upgrade their respective infrastructure, which they then passed on to all consumers, not just the big ones that forced the upgrade.

This, alongside other environmental issues, has caused many Americans to push back against data center projects near their communities. The White House instituted the “ratepayer protection pledge” and made AI hyperscalers, utility operators, data center companies, and individual states promise that they will protect the average consumer from electricity cost increases. But so far, no state has taken a step to codify this pledge into law. Oregon actually enacted the POWER Act, which resulted in a 30% increase in the power bill of users that consumed more than 20MW while slashing the bills of residents by 1.3%, but the state did this in 2025, way before President Donald Trump called the tech giants into the White House and told them to “pay their own way.”

The mountains of cash that these tech giants are pouring into AI are also affecting the memory and storage chip industry. Since these AI hyperscalers have a lot of liquidity from investors, they are willing to pay top dollar for the HBM they need to run their data centers. Because of this, it made sense for Micron, Samsung, and SK hynix to prioritize them over DRAM, especially as they can charge a premium for these chips and there are customers who are willing to pay at those prices. This resulted in a shortage of consumer memory that started in 2025 — while this initially affected PC builders and enthusiasts, it has started to affect other industries that require memory as well, including cars and smartphones. Even Apple, which historically had huge sway over its suppliers, was forced to increase prices because of the shortages.

Aside from skewing other industries, the massive CAPEX the big four are going into is alarming some experts, warning that the promises and contracts they’re making are leading to “hidden debt” not listed in their balance sheets. The amount, worth around $1.65 trillion, is annotated in their quarterly financial statements as future obligations that will only come into play as the related asset or service comes online. The current value is 122% of the actual debt reflected on their balance sheets, which could give investors the wrong impression that they have fewer obligations than they actually have.

While the amount of money that the big four are spending on AI might seem dizzyingly high, we must note that these companies are raking in massive amounts of cash quarterly themselves. Microsoft’s latest quarterly revenue is $90 billion, while Meta made $60 billion in the same period. Alphabet (Google) announced revenue of nearly $120 billion, while Amazon made $200 billion. That is a total of nearly $470 billion for these companies in just the last quarter.

Still, that does not mean that they can just keep on spending on AI. For example, even though Google’s cloud business had a revenue of $11 billion last year, its price dropped after it announced that it spent more than it made last quarter — the first time this happened in the 20 years since it went public. Meta is also planning to rent out its AI compute, apparently following in the footsteps of Amazon, Google, and Microsoft, which have growing cloud businesses. However, this announcement caused a drop in its stock price. “They are a bit all over the place,” SLC Management managing director Dec Mullarkey told FT. “For investors it’s no longer growth at any cost; they want to see the spending flowing through to results, like at the Big Three.”

Microsoft announced that it’s increasing Minecraft’s minimum and recommended system requirements for the first time in 17 years. According to the company’s blog post, Minecraft: Java Edition will get a spec bump to ensure that the game runs smoothly today and in the future. While it’s understandable that the game’s developers would want to increase the performance of the hardware that the title runs on to implement more advanced features, the new requirements are significantly higher than the previous minimum specification. This could negatively affect players on older hardware that barely hits the minimum requirements, who would have no choice but to upgrade their PCs at a time when RAM prices are at a record high.

The new minimum specifications are quite reasonable, with the recommended specs falling squarely within the performance of the most common hardware in June’s Steam Hardware Survey (which also indicates that AMD now has more than 45% market share compared to Intel). If your system used to be at or higher than Minecraft: Java Edition’s previously recommended specifications, but no longer hits the current minimum requirements, you can switch over to the Bedrock Edition to continue gaming, although you might have to forgo some of your favorite mods.

If you’re running the bare minimum hardware to play Minecraft, Microsoft said that you could still possibly launch the game, although it warned that you might run into some issues. “These updated recommended system requirements won’t stop you from playing Minecraft: Java Edition today. If your computer falls below the new minimum requirements, Java Edition should still launch,” the company said in the Minecraft blog. “However, its performance and visual quality are no longer guaranteed on below-spec hardware, and it may struggle or fail to launch Java Edition in the future – especially as we transition away from OpenGL and towards Vulkan. We will keep players informed of these changes, especially changes that will sunset hardware that previously supported Minecraft: Java Edition.”

This means that you’ll have to spend some money to upgrade your system to just to continue playing your favorite game. You don’t have to spend thousands of dollars to get a new PC or join a giveaway to be able to play, though. If you know what you’re looking for, you can plausibly buy a used gaming laptop or desktop PC for around $350 to $500 — that should give you about a decade or more to enjoy the game if Microsoft keeps its spec upgrade cadence of 17 years for future versions of Minecraft.

Xbox has announced a new Xbox Backward Compatibility for PC program, which will let gamers play a selection of classic Xbox titles on PCs and handhelds, a move the company says marks the beginning of a bigger push into Xbox game preservation. The announcement begins with four titles that can now be played on PCs and handhelds, including the ROG Xbox Ally and Ally X.

"This marks the beginning of a broader effort to preserve XBOX games from the past and bring them to PC over time," the company said in a blog post authored by Xbox "VP next generation" Jason Ronald. Alongside backward compatibility, the company says games will also include new features. The four titles in the announcement are:

• BLiNX: The Time Sweeper 
• Conker: Live and Reloaded 
• Crimson Skies: High Road to Revenge 
• Fuzion Frenzy

You can now buy all of these games on PC, and they're also included in all Xbox Game Pass plans. Anyone who already owns these titles digitally on console can also now play them on PC or handheld, with support for Xbox Play Anywhere and Xbox Cloud Gaming. Crucially, this appears to be a digital-only preservation effort, so it won't help anyone who only owns physical copies of these games. Xbox has reportedly been testing a way to digitize physical games as far back as Xbox One, but that hasn't yet materialized yet.

Alongside the preserved original gameplay, Xbox claims these games will let users customize graphics settings, with up to 4x resolution scaling, VSync support, Fullscreen and Windowed modes, anisotropic filtering, and enhanced anti-aliasing, with more features to come in the future. Notably, Xbox will add achievements to select original Xbox games on console and PC.

Users who want to play these titles will need to meet the following system requirements:

Microsoft's emphasis on preserving older games is particularly noteworthy given recent backlash against Sony over its decision to end physical games with its next console generation, and the shuttering of some of its online stores. While Xbox's digital emphasis on game preservation still can't match the solidarity of physical media preservation, the timing of this announcement seems like more than just a coincidence.

Five U.S. tech giants heavily invested in AI and its related infrastructure reportedly have an estimated $1.65 trillion in hidden debt, with the figures annotated in their quarterly financial statements instead of being listed in their balance sheets. According to Nikkei Asia, this is higher than the $1.35 trillion officially listed, meaning investors could be caught unaware once the hidden figures come to light.

The publication says that Meta has a high off-balance-sheet-to-recorded-debt ratio, with the company owing $420 billion in unlisted debts compared to the $140 billion written on the balance sheet. Oracle purportedly also has a massive $273.3 billion of hidden debt, which is a 2,900% jump from the hidden debt it had from 2022.

This may sound strange, but it’s actually an accepted accounting practice. The “hidden debt” stems from long-term contracts that have been signed but have not come into force yet, which, Nikkei says, is mostly related to the billions of dollars promised to data center operators. The AI race has got many hyperscalers signing contracts and agreements with data center operators, saying that they will pay for the compute they generate once their project goes online.

While any institution promising to pay any amount of money for services or goods delivered is obliged to list them as a liability, the fact that these data centers haven’t started operations means that these agreements are off-the-books at the moment. But when these projects come online, the contracts that the tech giants have signed will come into force, and they’ll have to pay for the compute that these sites will deliver, no matter if there is demand or not.

Nevertheless, these tech companies aren’t just pouring money into future contracts just for the sake of it. Alphabet, Amazon, and Microsoft reportedly have a cloud service backlog worth $1.45 trillion, meaning these are services yet to be rendered and paid. Amazon Web Services CEO Matt Garman also told the publication that the investments that the company is getting into are “not speculative.”

While this may seem like a good way to secure capacity — sign customer contracts that guarantee demand and then enter into long-term agreements with data centers to get the compute needed to deliver the services- it opens these tech giants to massive amounts of risk. That’s because if the demand fails to materialize, then they’d be left paying for excess compute without having any customers to sell them to. What’s more alarming is that Nikkei says that these investment expenditures are exceeding their earnings, meaning these big tech companies are increasingly relying on corporate bonds and new shares to fund them.

Even though demand for AI compute is increasing, it’s still a relatively new and unproven technology, with many experts saying that it should benefit more people to avoid a bubble. The cost of using AI for nearly everything, called “tokenmaxxing,” has also caught some companies by surprise, with agentic AI eating up annual AI budgets in a matter of weeks. Because of this, some companies are reducing their use of AI or are switching to more affordable models from China. This uncertainty, paired with the way tech companies “hide” these liabilities, is quite concerning, as they would appear to have less long-term obligations than they actually do.

This isn’t the first time that an industry giant has used similar accounting techniques. The publication cited Enron’s 2001 collapse, which was due to the company hiding its troubled assets through special purpose entities and marking unrealized gains from trading contracts into its current income statements. While the tech giants are not hiding underperforming assets off their balance sheets and committing fraud, they’re still using a similar mechanism to list their upcoming obligations. Although these are technically not debt, they still behave like one, and the way they’re reported is what’s concerning some experts.

The demand for AI compute is already insatiable, and it seems only poised to grow in the wake of the introduction of frontier-class open models like Kimi K3 that anybody can potentially fine-tune and serve. Against this backdrop, Microsoft and AMD are teaming up to get Redmond more AI FLOPS for both internal and external use. The two companies announced this morning that Microsoft will commit to adding AMD's Helios rack-scale AI accelerator in volume to run frontier-model workloads in its own data centers, as well as for Azure AI infrastructure customers and services.

The partnership makes next-gen AMD AI compute available to Azure customers like AI labs for AI training and inference serving workloads, and it’ll also underpin managed compute for enterprise customers looking to deploy AI workloads through Microsoft Foundry.

The two companies didn't indicate the exact size of Microsoft's Helios deployment in either watts or dollars, but the commitment would seem to be another major win for AMD as it seeks to grab data center GPU share from Nvidia. AMD has struck massive partnerships with OpenAI and Meta in the past year with gigawatts of compute installations and hundreds of billions of dollars potentially hanging in the balance.

For a quick refresher, the Helios rack-scale accelerator will take the fight to Nvidia’s Vera Rubin NVL72 system when it arrives later this year. Helios joins together 72 next-generation Instinct MI455X GPUs with an aggregate of 31.1TB of HBM4 memory capacity across the system. Those GPUs offer as much as 1.4 exaFLOPS of FP8 compute and 2.9 exaFLOPS of FP4 for AI models using those OCP AI data types.

AMD is targeting 260 TB/s of scale-up bandwidth within the rack, on par with Nvidia’s Vera Rubin NVL72 rack-scale system, and 43 TB/s of scale-out bandwidth using UALink over Ethernet, or about twice that of Vera Rubin, although the performance of UALink over Ethernet in practice remains to be seen.

Microsoft and AMD also announced that Azure will add two new VM series built on AMD's upcoming sixth-gen Epyc Venice CPUs: the HDv2 series for "agentic AI and data pipelines," and the HXv2 for semiconductor design workflows. Microsoft will also leverage its existing deployment of AMD Pensando DPUs to integrate that hardware into its Azure Boost offerings to accelerate networking and storage processing operations.

Tom’s Hardware will be on the ground at AMD’s Advancing AI event this week, where we expect to learn more about AMD’s AI ambitions for the second half of this year and beyond. Stay tuned for our coverage from that event.

Windows 95 worked out whether a setup program had run by reading the executable's name and checking it against a short list of hard-coded words, according to Microsoft engineer and semi-official Windows historian Raymond Chen, sharing the details via his Old New Thing blog. A filename containing "setup," "install," or "inst" flagged the program as an installer, which triggered the operating system's routine for repairing system files that installers had damaged. Three non-English entries appeared on the same list, which Chen identified as his own guesses at Italian, Turkish, and Hungarian.

The full match list ran to six terms: setup, install, inst, imposta, ayarla, and felrak. Chen wrote that "install" was redundant, because any name containing it already contains "inst," and speculated that the shorter entry was added later to catch installers named along the lines of "blahinst" without anyone deleting the original. A program whose own name produced no match got a second test, with Windows 95 checking whether the word "Setup" appeared anywhere in the path to the executable. A separate live check ran after any multimedia driver was installed through an INF file, added because those drivers frequently overwrote system DLLs.

This heuristic gated a recovery mechanism Chen described in March. Installers of the period overwrote system files without checking versions, disregarding Microsoft's rule that a file should only ever be replaced by a newer one. An installer carrying Windows 3.1 copies of shared DLLs, for example, would bury the newer Windows 95 versions underneath them, and every program that relied on the current files would break.

Windows 95 kept backup copies of commonly clobbered files in a hidden C:\Windows\SYSBCKUP directory. It would then let each installer finish, check its work, and restore the correct versions where the installer had downgraded them. This safety net depended entirely on correctly guessing that an installer had run, so a setup routine with an unusual name slipped past it, while an ordinary program named something like instant.exe tripped it for nothing.

The file check was often deferred until the next boot rather than run immediately, with Chen explaining that some installers, unable to replace a file already in use, would drop back to MS-DOS, run a batch file to swap the file, and restart Windows, so the cleanup pass had to wait for the reboot to catch anything the batch file had altered.

Windows 2000 debuted a new approach

Microsoft dropped this approach in Windows 2000, which introduced Windows File Protection. That system registers for file-change notifications through Winlogon restores protected files from a cache at %WinDir%\System32\dllcache, with no filename guessing and no waiting for a setup program to complete.

Then, Windows ME shipped a comparable System File Protection, and Vista onward moved to Windows Resource Protection, which guards files using access-control lists instead. The sfc /scannow command that Windows 11 users still run to repair system files descends directly from that work, having replaced a 1995 mechanism that decided when to act by scanning filenames for the word "setup."

A Brazilian gamer who lost his Microsoft account and all his digital games has won a court order forcing the company to hand it all back, after support staff told him to simply repurchase his library. The user, who posts as Ordo_Liberal on Reddit, shared a screenshot of a small-claims ruling in the Xbox subreddit that gives Microsoft 15 days to restore access or face fines and roughly $400 (R$2,000) in damages. He said the account had two-factor authentication enabled when it was flagged and permanently suspended, and that none of Microsoft's recovery options allowed him to regain access before he filed his lawsuit.

According to the support emails he posted, Microsoft suspended the account after detecting what it described as unauthorized access, and said an investigation found the account's security information had been changed. The company treated the suspension as permanent and directed him to buy his games again rather than reinstating the ones already tied to the account.

Anyone with a large Microsoft account might want to take note here, because the suspension didn’t target a single game or console but the user’s entire account. Microsoft accounts can carry Xbox purchases, Windows licenses, store apps, 365, and OneDrive data, and a permanent suspension blocks all of it, even, as in this case, when you’ve got strong security and two-factor authentication set up.

Brazil's Consumer Defense Code and its small-claims track allow individuals to bring cases without a lawyer and without paying court costs, meaning Ordo_Liberal was able to take Microsoft to court without incurring any costs. If Microsoft misses the payment deadline, an additional 10% penalty will be imposed. While the damages awarded in this case are minor, it's notable that Microsoft has been compelled to restore the account and its contents, which runs counter to the standard platform position that customers license digital games rather than own them.

This, of course, is a first-instance small-claims judgment, not binding precedent, and it covers one account in one jurisdiction. Courts elsewhere have gone the other way. Chinese courts have recognized game accounts as inheritable property, while U.S. rulings generally treat games as revocable licenses. The case comes as both Microsoft and Sony push players away from physical media, with Xbox testing a way to convert discs into digital entitlements and Sony ending new PlayStation disc production in 2028. Microsoft hasn’t publicly commented on the ruling.

Microsoft’s emissions for fiscal 2025 (FY25) rose by 25% from the previous year, even as the company’s 2030 deadline to become carbon-negative draws closer. According to the company’s 2026 Environmental Sustainability Report, released on Thursday, July 9, the backward step was driven primarily by the rapid expansion of its data center infrastructure and its decision to stop using short-term renewable energy certificates, which reduced its reported footprint without necessarily adding new clean electricity to power grids.

Microsoft reported approximately 20.3 million metric tons of carbon dioxide-equivalent emissions across its operations and supply chain, up from 16.2 million tons in fiscal 2024 and nearly 58% above its 2020 baseline. Electricity consumption increased by 24% during the year as the company built the computing capacity required for its cloud and AI businesses. Regardless, Microsoft says it remains committed to becoming carbon-negative, water-positive, and zero-waste by 2030. It also reported meeting its 2025 renewable-electricity target, replenishing more water than it withdrew globally, and exceeding several waste-recovery targets

The report’s foreword, written by Microsoft Vice Chair and President Brad Smith and Chief Sustainability Officer Melanie Nakagawa, focused heavily on the collision between the company’s headline sustainability goals and the realities of AI. Microsoft established the goals in 2020, a few years before the current scale of AI’s capabilities and the corresponding high environmental demands began to manifest.

While AI is inarguably a world-changing technological revolution, it is raising serious environmental concerns that begin right at the raw material sourcing and the complex semiconductor fabrication stages. The impact continues even after the processors have been compiled into supercomputers in massive data centers, with issues related to land use, energy consumption, noise pollution, and water consumption. Residents are increasingly opposing the building of these data centers in their communities due to these issues.

Microsoft is exposed at nearly every point of the AI chain. It procures servers and custom AI chips; owns and operates a massive, global network of over 300 data centers across 34 countries that powers the Azure cloud platform; and supplies the computing infrastructure behind products such as Copilot and its partnership with OpenAI. Scope 3 emissions from construction, purchased hardware, suppliers, and other value-chain activities remain the largest part of its footprint. Meanwhile, electricity-related Scope 2 emissions grew from nearly 2% of the total in 2024 to 13% in 2025.

Microsoft acknowledges that environmental solutions are not expanding as quickly as AI infrastructure. “This tension is real,” the foreword states. “It is forcing sharper questions: Where do we need to move faster, invest differently, or rethink our approach?” The company argues that the answer is not to retreat from AI, but to combine carbon-free electricity, carbon removal, sustainable fuels, lower-carbon construction materials, hardware reuse, and efficiency improvements into a single portfolio rather than treating each environmental target separately.

Its decision to stop buying non-additional, unbundled renewable energy certificates forms part of that change. These certificates can allow a company to claim renewable electricity already being generated elsewhere. Microsoft says it will instead prioritize longer-term agreements that help add additional carbon-free generating capacity to the grid, even though doing so will increase its reported emissions in the near term. Its renewable-energy agreements now cover up to 40 GW across 26 countries, with approximately 19 GW operational.

The company is also modifying the data centers themselves. It introduced a closed-loop liquid-cooling design that CEO Satya Nadella says enables AI data centers to use about as much water annually as a restaurant. Microsoft is experimenting with microfluidic channels etched into silicon, zonal cooling that reserves colder liquid for the hottest equipment, and lower-carbon concrete, steel, and mass timber for its construction. These efforts have not exactly quelled anti-data-center sentiment around its data centers. The company faced protests over a planned facility near Granger, Indiana, while residents living near its $7.3 billion Fairwater AI complex in Wisconsin have filed a lawsuit alleging persistent noise, dust, traffic, and light pollution.

Away from carbon, the report records clearer progress. Microsoft replenished 14.2 million cubic meters of water, exceeding its global withdrawals for the first time, and reduced average data center water-use effectiveness by 25% from its 2022 baseline. It achieved a 92% reuse and recycling rate for retired cloud hardware, diverted 90.5% of construction and demolition waste from disposal, and reduced single-use plastics in primary product packaging to 0.07%. It also legally protected 16,266 acres of land, approximately 36% more than the land estimated to be occupied by its operations.

The report is equally candid about where Microsoft is falling behind. The company's most important commitment—becoming carbon-negative by 2030 — is moving further away rather than closer. Total greenhouse-gas emissions climbed 25% year over year and now sit roughly 58% above the company's 2020 baseline, largely because AI infrastructure is expanding faster than its decarbonization efforts can offset. Scope 2 emissions also jumped sharply, rising from nearly 2% of Microsoft's footprint in FY24 to 13% in FY25 as electricity demand from new data centers surged. While Scope 3 emissions remain the company's largest source of carbon pollution, the report says the growing contribution from purchased electricity underscores how increasingly difficult it is to power AI infrastructure with clean energy alone.

The Internet is buzzing over news that 19-year-old Estonian "hacker" Peter Stokes got nabbed by the authorities and extradited to the U.S. on digital crime charges, mostly thanks to Microsoft Windows' built-in telemetry. The FBI seemingly subpoenaed Microsoft, which coughed up telemetry logs that contained both Stokes' GDID (Global Device Identifier) and websites he visited using his main Windows machine.

The existence of GDID isn't new by itself, as Windows telemetry's data collection has been extensively analyzed and reported on. It's also been known, and publicly explained by Microsoft, that the extended telemetry modes (Full/Optional instead of Required/Basic) can upload lists of URLs analyzed by SmartScreen and Defender, together with the GDID. In fact, using the Edge browser in this setup can even send every visited URL. The court documents do not reveal which exact mechanism triggered the telemetry upload, though.

This data collection has long been the source of heated debate and general public disgust. Even though the data is genuinely useful and necessary for debugging (by Microsoft or systems administrators in enterprise environments), the fact that it comes enabled by default in Windows Home and Professional editions is questionable. The fact that those versions don't have a simple, user-facing "Off" switch to fully disable telemetry also adds insult to injury.

The Peter Stokes arrest appears to be the first public case where these Windows GDIDs were both used as a tracking identifier and contained telemetry data including some of the URLs the defendant visited. The case also prompted a renewed analysis of the GDID by a security researcher that you might want to look into. From what we can ascertain, it's likely Stokes had his Windows telemetry set to Optional/Full, as Required/Basic doesn't appear to transmit URLs by default.

Using the telemetry GDID, the FBI easily connected the dashing rogue to his ngrokaccount, because he used that tool in the same session in which he accessed his Facebook and Snapchat accounts. The agents also established a link between travel records, a New York IP address, and a rental at the Empire Hotel, likely facilitated by the photos Stokes posted of his hotel room. The criminal mastermind was equally sneaky (read: not) in his visit to Thailand.

As many hackers do, he enjoyed some time off playing an obscure game, in this case Ubisoft's Growtopia, shortly before accessing his Apple logins, as well as the aforementioned Facebook and Snapchat logins over the following weeks. Besides Microsoft, Google and Apple also collaborated on the hunting effort, with Google linking Stokes' phishing phone number to the same exact IP address and date where he created the ngrok account. Ever the stealthy craftsman, Stokes had created the ngrok account using the same GMail address connected to a second phone number where he made phishing calls from.

While it's easy and arguably quite necessary to hoist pitchforks at Microsoft for collecting detailed information about billions of computers by default, security professionals will be quick to remind users that Windows' telemetry is merely one of the many ways to track a user. Even if not by malice, a lot of software simply requires GDID-like identifiers for things like tracking usage, subscription and licensing limitations, activation requests, and hardware detection. And every company behind such software can be subpoenaed by authorities, as exemplified in Stokes' case by Microsoft, Google, Apple, ngrok, and others. Even privacy-oriented services like Proton are careful enough to describe what they can and cannot reveal to authorities under a court order.

If you're wondering the steps Stokes took to cover his tracks, though, you'd be looking at a small list. He did route his connections through a VPN hosted at servers from Tzulo along with the developer-oriented ngrok tunneling service and teleport.sh. Unfortunately, the modern digital world allows for many forms of identification, and hiding one's source IP address is merely one of them.

Using a VPN is recommended for digital anonymity, but it's merely the first of many necessary steps and can even backfire when not set up carefully. If misconfigured, a VPN may allow certain applications and operating system features to talk to the outside world using the original IP instead of the hidden one. Plus, the VPN will not stop the operating system or any application from sending out identifying information to begin with.

Perhaps more worryingly still, modern-day device and user fingerprinting is far more insidious and hard to counter. For example, plain web browsers are notorious leakers of personal information, as data-harvesting companies can weaponize features like TLS levels, HTML5 Canvas functionality, the fonts list, and even Widevine DRM in a combination that uniquely identifies a visitor. Stokes now has plenty of time to read up on the EFF's surveillance self-defense guides and get acquainted with the scripts at the Privacy Is Sexy website.

Controversy due to AI data center buildouts generally centers around their massive power usage and draining of local water reserves, but noise is a third torment to nearby residents, and one that is arguably much harder to correct. Residents of Sturtevant, slightly south of Milwaukee, Wisconsin, filed a class-action lawsuit against Microsoft due to the excessive noise produced by the company's Fairwater facility. CEO Satya Nadella described the project as "the world's most powerful AI data center," projected to generate 865,000 tokens per second and have a final bill of $7.3 billion.

The Sturtevant residents live just 1.5 miles (2.4 km) from the facility. The lawsuit was filed by three citizens and represents the households within this distance, reportedly amounting to over 1,000 homes, including areas in Mount Pleasant. The filing describes the noise situation as "not only excessive, but consistent and pervasive," and claims Microsoft did not "implement adequate acoustic barriers, shields, or walls that absorb, mitigate, and/or prevent the escape of noise, thereby resulting in the offsite emission of excessive noise beyond its property." One resident claims he had to change his shift at work to be able to sleep at all.

Nearby residents also complain about excessive dust and traffic stemming from the construction work, as well as light pollution. One resident says he often can't see his house coming into town, while another claims that before the data center arrived, the sky was dark and full of stars, now mostly gone due to the bright lights.

To some credit, Microsoft appears to have been trying to improve the situation, judging by a fairly detailed blog post on its community website. On June 18, the company said its engineers applied several measures that "fully resolved the issue," and that it would apply additional mitigations over the following months, including "additional sound reduction components."

The backstory in the post says the firm was aware of the issue back in April, and "[it] did not expect the tonal quality of the sound to travel as far as it has," attributing the decibels to cooling fans operating at too-high speeds, now purportedly corrected. In an earlier project update about the data center, Microsoft says it would have street sweepers working 10 hours a day and limit construction to hours between 6am and 10pm.

The lawsuit was filed on July 1, indicating that either the issue isn't resolved, or that the particularly short distance between Fairwater 1 and Sturtevant might make for a conundrum that's exceedingly tricky to solve. Some Mount Pleasant residents even live across the street from the campus, too. Before the Fairwater data center arrived, the land was already zoned for heavy industrial use back in 2017 to Foxconn, a status that carried over to Microsoft upon purchase. Notably, Wisconsin's "direct legislation" apparently does not allow amending or repealing existing ordinances, and is only available to cities, not towns.

The Department of Justice, with the help of the FBI and Finland's National Bureau of Investigation, has arrested a teenager it says is part of Scattered Spider. 19-year-old Peter Stokes is a dual U.S.-Estonian citizen who was trying to board a flight to Japan from Helsinki, when law enforcement caught up with him. Microsoft's GDID also played a part in the Stokes being apprehended. The accused is now awaiting trial, having been charged with conspiracy, cyber intrusion, and fraud.

Scattered Spider is one of the biggest cybercrime syndicates on the planet, having extorted over $100 million in ransom payments, according to the DOJ. The group also operates under the names Octo Tempest, UNC3944, and Oktapus, and is renowned for its social engineering tactics. As such, the main criminal complaint against Stokes stems from a May 2025 attack on a luxury jewelry dealer based in the United States.

The attackers apparently called the company's IT helpdesk using Google Voice, posing as employees. They were able to convince the help desk into resetting their credentials, which allowed them to infiltrate three accounts, two of which had admin privileges. From there, the group, allegedly including Stokes, stole important data and held the jeweler at ransom, demanding an $8 million payment in crypto.

The company ultimately regained access to their infrastructure and avoided paying the ransom, but the operational disruption still caused a purported $2 million in losses. This served as the spark that led to Stokes' eventual arrest in Helsinki, as the prosecutors slowly followed the paper and digital trail laid by the attackers. Microsoft played a key role in the process by providing GDID data to the FBI to help them apprehend the alleged criminal.

GDID stands for Global Device Identifier; it's a unique identifier assigned to every Windows install that tracks device-specific telemetry. It's the reason why sometimes changing a major component in your PC can revoke your Windows license. Anyhow, the court documents from the case reveal that Stokes used Windows, from which investigators were able to link his physical hardware to specific internet activity and locations.

From what we can tell, GDID pretty much had a comprehensive report on Stokes ready before the prosecution even built its case and it was only a matter of connecting the dots. Stokes' web activity, videogame history, IP addresses, tool usage (including Ngrok), Azure status, and more were logged with timestamps, and were provided to the investigators by Microsoft.

Of course, this raises questions over just how granular and potentially invasive Microsoft's telemetry can be. In this case, it was used to arrest an alleged hacker, but what if someone else, someone with malign intentions, were to get access to all this data instead? Tech-savvy consumers have complained about Windows' excessive telemetry for a long time; the whole debloating culture is a byproduct of this precedent, but GDID is not something you can remove or disable with the click of a button.

Nevertheless, Stokes was carrying two hard drives full of incriminating evidence with him when boarding his flight to Japan, so that helped, too. His real identity has actually been known since 2024, but since he was a minor living across Estonia and the UAE at the time, he could only be monitored until the time was right. Following the arrest, Stokes was extradited to the U.S., where he appeared in front of a federal court in Chicago for the first time on June 30, 2026, and he remains in custody.

Microsoft is further shrinking its Surface lineup of flagship Windows devices. According to a report from Windows Central, citing "sources that are familiar with Microsoft's hardware roadmap," the company is no longer manufacturing its budget-focused Surface Go 4 and Surface Laptop Go 3, and doesn't plan to follow them up with new devices.

Over the last few years, Microsoft has discontinued many of its most interesting designs, including the powerhouse Surface Laptop Studio, the Surface Studio desktop, Surface Headphones and Earbuds, the Surface Book, and the Surface Duo smartphone. The entire line has been simplified down to the Surface Pro and Surface Laptop, with the Surface Laptop Ultra coming later this year with Nvidia's RTX Spark. (Microsoft's RTX Spark Dev Box is also Surface-branded, but isn't consumer-facing).

But the Surface Pro and Surface Laptop each come in more sizes than ever. The Surface Pro comes in 12- and 13-inch sizes. That 12-incher, starting at $849 with Snapdragon X Plus, could arguably be a replacement for the Surface Go, except that it's far more expensive than the Surface Go 4 was priced at $579. On the Laptop side, there are 13-, 13.8-, and 15-inch systems, with the smallest using the same chip at $949.99 that could be considered the entry-level option.

It's possible that you may find these systems in stock at some retailers, but they're hard to find. The Surface Go 4's last iteration was only ever part of Microsoft's Surface for Business line and was seemingly popular with commercial customers that needed a device for fieldwork.

Microsoft didn't immediately return Tom's Hardware's request for comment. A representative pointed Windows Central to Microsoft's Surface website, which doesn't list either the Surface Go or Surface Laptop Go, but just a simplified lineup of the Surface Laptop, Surface Pro, and upcoming Surface Laptop Ultra and the Dev Box.

Windows Central's sources suggested that the decision to end these device lines was made prior to memory price hikes due to component shortages. Either way, with just two main device lines, Surface, which used to be a playground for form factors under former head Panos Panay, has been extremely simplified and far less experimental —if you could call it that at all.

Microsoft has extended its free consumer Windows 10 Extended Security Updates (ESU) program by a year, pushing the cutoff for critical security patches to October 14th, 2027. The change came without any actual announcement, appearing instead in an edit to Microsoft's Windows 10 ESU support page. Devices already enrolled roll over to the new date automatically, with no action required from users. The program was originally set to expire on October 12th, 2026, one year after Windows 10 reached end of support on October 14th, 2025. With the extension, however, users who can’t or won’t move to Windows 11 now have a second free year of patches.

Speaking to BleepingComputer, Microsoft said that the change reflects “our ongoing commitment to helping customers stay secure during the transition,” adding that the extra year gives users “more time and flexibility to find the best PC for their needs while keeping them protected.”

In terms of enrollment, nothing has changed: users can enroll for free by syncing their PC settings to a Microsoft account through Windows Backup, by redeeming 1,000 Microsoft Rewards points, or with a one-time payment of $30. Users in Europe can enroll at no cost simply by signing in with a Microsoft account, a concession Microsoft made after pushback from consumer advocacy groups over its original requirements. A single ESU license covers up to 10 devices tied to the same account.

Microsoft's consumer program is limited to personal devices, however. Systems joined to an Active Directory domain or to Microsoft Entra, or managed through Mobile Device Management, are corporate-controlled and therefore not eligible. Personally owned machines that are only Entra-registered — e.g., a work account added to a personal device, rather than the device itself being organization-owned — still qualify.

Windows 11 has surged to roughly 73% of desktop share against Windows 10’s 26%, so it’s clear that the broader migration is working. Those users still on Windows 10 are increasingly the difficult edge cases, with around 400 million active PCs unable to officially upgrade to Windows 11 because their hardware fails its TPM 2.0, Secure Boot, or supported-processor requirements.

Users of those machines face a choice of remaining on unsupported Windows 10 or upgrading their hardware outright. But thanks to the AI-driven memory shortage, doing so has never been more expensive: DRAM contract prices have roughly doubled since early last year (and are expected to double again) as Samsung, SK Hynix, and Micron divert wafer capacity toward high-bandwidth memory for AI accelerators.

IDC expects PCs, tablets, and smartphone prices to rise 10% to 20% through the end of 2026, with memory now accounting for a far larger share of a system's bill of materials than it did two years ago.

For users unwilling to buy new hardware at current prices, some third-party options remain. The security firm 0patch has pledged to provide unofficial Windows 10 micropatches through 2030, and Linux migration efforts such as the End of 10 initiative continue to court holdouts whose machines can’t run Windows 11.

People seem all too ready to anthropomorphize LLMs and AI chatbots like ChatGPT, Claude, and Gemini. Some humans even admit to ‘relationships’ with one or more of the various examples of machine intelligence. To illustrate how flawed this instinct could be, a Microsoft AI researcher built a tiny neural network inside Age of Empires II using goats, grass, and bridges. Adrian de Wynter shared his work in a paper dubbed If LLMs have human-like attributes, then so does Age of Empires II. The Microsoft researcher, based at the University of York, also talked to 404 Media recently about how he likes to turn absurdism up to 11 to make a point.

In the research paper, De Wynter doesn’t make the argument that LLMs do or do not actually have generalized anthropomorphic attributes. Instead, he illustrates that the AoEII goats can also power the kinds of models that lay behind today's most popular chatbots. That hammers home the argument that “in no case is a machine’s activity to be interpreted in terms of higher cognitive processes, if it can be fairly interpreted in terms of processes which stand lower in the scale of cognitive evolution and development.”

De Wynter also raises the well-known concept of confirmation bias. Those looking for human traits in tech like chatbots will tend to find them, he proposes. However, the big contrast between the absurdist goat example and the commercial LLM chatbot is the way people interact with them, the interface that makes the likes of Claude ‘conversation friendly.’ De Wynter’s research indicates that anthropomizing LLMs is a common trend in computer science papers. From 337 such papers De Wynter looked at, published in the last two years, he says that 57% assumed that LLMs could have human-like traits. This basic assumption could color the research, testing, and, of course, conclusions of these papers.

So, how did the Microsoft AI researcher build the goaty AoEII LLM? Well, he didn’t quite go as far as developing a full-blown LLM. Instead, De Wynter thought it sufficient to use AoEII’s scenario editor to build a working NAND gate, with a 1-bit perceptron, where the goats act as bits. This crude perceptron and the circuit to train it in-game are enough to demonstrate that the simplest building block of a modern neural network could be made this way. And if you think it is absurd that AoEII goats can embody consciousness, then it should be equally absurd to regard any of the well-known chatbots as anything more.

Companies behind the AI boom aren’t discouraging people from anthropomorphizing their wares. In many ways, they might benefit from these human perceptions. Chatbots they deploy are trained with natural language and use techniques to mimic the shape and tone of natural conversation. This makes it easy for users to project personality, emotion, or even consciousness onto them. Top AI company execs have leaned into the perception of their customers, publicly entertaining the idea that their systems could or might be exhibiting signs of consciousness. In his 404 Media interview, De Wynter also highlighted research indicating that people buy more products when they can empathize with them, and that includes AI/chatbot/LLM subscriptions.

Microsoft has quietly updated its consumer-oriented Surface lineup with Qualcomm's Snapdragon X2 chips. The Surface line, often announced with its own event, has been detailed in a blog post by corporate vice president for Surface Brett Ostrum. All three systems are on sale from Microsoft's website today. The 13-inch Surface Pro starts at $1,499, while the Surface Laptop line starts at $1,599 for the 13.8-inch machine and $1,699 for the 15-incher.

The new systems aren't particularly different on the outside, coming in platinum, black, and dune colors that Microsoft has used before. The 13.8-inch Laptop option will have one brand new color: a standout jade green.

All of the systems will have options between 10-core Snapdragon X2 Plus or 12-core Snapdragon X2 Elite processors, and range from 16GB to 64GB of RAM (some of the Surface for Business models Microsoft announced with Intel's Panther Lake processors start with just 8GB of memory).

The Surface Pro starts with 256GB of storage and goes up to 1TB, while the Surface Laptop 13.8 goes up to 2TB. The 15-inch Laptop starts at 512GB and goes up to 2TB.

While all of the devices use Microsoft's PixelSense Flow displays with variable refresh up to 120 Hz, but only the Surface Pro includes both LCD and OLED options. The touchpad on the Surface Laptop has new haptic feedback technologies, working with Windows for small pieces of feedback throughout Windows. On the Surface Pro, you can get similar feedback with the Slim Pen.

The Surface Laptops have 1080p cameras that Microsoft boasts are best in class with No. 1 rankings from DXOMARK. That judges color, texture, noise, and artifacts, but doesn't seem to consider resolution. Some premium PCs have 4K or higher webcams now.

Microsoft is promising up to 20 hours of battery life on the 13.8-inch Surface Laptop when measured with local video playback. That drops to 16 hours when tested with web usage. We'll have to see how that holds up in our labs.

All three devices maintain Microsoft's Surface Connect port, and come with 39W chargers in North America. Microsoft notes that these aren't available in Europe, the Middle East, and Africa, so buyers in those locales will need to bring their own.

Business-focused models using Intel chips will launch on July 14.

Update, June 16, 10:26 a.m.: Microsoft shared a change to their spec sheet. The 13.8-inch Surface Laptop Pro will start with 512GB in the United States.

Microsoft CEO Satya Nadella has claimed that the company's newest generation of AI data centers uses so little water that its annual consumption is roughly equivalent to that of a single restaurant. Speaking at Microsoft Build 2026 on June 2, Nadella made the claim while outlining Microsoft's "Community-First AI Infrastructure" strategy aimed to address growing concerns about the impact of data centers on local communities.

"The cooling loop is filled once, and the data center can operate effectively with zero water consumption," Nadella said during his keynote, while describing how new architectures are redefining data center water consumption. "The daily water usage over the course of an entire year is roughly equivalent to what a single restaurant would use."

While Nadella did not specify the size or type of restaurant used for comparison, the claim is striking given the scale of modern hyperscale AI facilities. Industry estimates suggest that restaurants can consume anywhere from several hundred thousand to more than a million gallons of water annually, while 100MW+ hyperscale data centers have historically required tens to hundreds of millions of gallons of water annually for cooling, depending on climate, workload, and cooling design.

Nadella's statement — not the first time Microsoft has used a restaurant comparison — is based on Microsoft's new closed-loop liquid-cooling architecture. Traditional data centers often rely on evaporative cooling systems that continuously consume water to remove heat generated by servers and networking equipment. In Microsoft’s new approach, over 90% of the facility's cooling relies on a closed-loop liquid cooling system that is filled during construction and then continuously recirculates the same water rather than constantly consuming a fresh supply. The remaining portion of the cooling system primarily relies on outside air and only uses additional water in the hottest conditions.

The system works by circulating cooled water through heat exchangers connected to the AI hardware. As the water absorbs heat, it is routed to a massive chiller plant where large cooling fans dissipate the heat before the water is recirculated back through the facility. Because the water remains in the cooling loop rather than evaporating and being discarded, ongoing water consumption is dramatically reduced. This can translate to savings of multiple billions of gallons of water across Microsoft’s data centers.

The current reality is much more subdued. The new cooling design and its water savings are currently implemented only at Microsoft's Fairwater AI data center campus in Mount Pleasant, Wisconsin. On the other hand, the company has stated that the new cooling approach will become the standard design for future AI-focused data centers. Microsoft has confirmed that multiple identical Fairwater facilities are already under construction elsewhere in the United States as part of a broader expansion of its AI infrastructure footprint. The rollout forms part of Microsoft's longer-term goal of becoming water positive by 2030, meaning the company aims to replenish more water than it consumes globally, as part of its community-first strategy.

While the new cooling design will substantially reduce water use in future facilities, critics note that Microsoft already operates a vast global network of data centers. Azure now spans more than 500 facilities across 80 regions worldwide, many of which were built before Fairwater's cooling architecture was introduced.

Microsoft has not announced a comprehensive retrofit program that would convert existing data centers to the new closed-loop design. As a result, the "restaurant-level" water footprint applies primarily to newly built facilities that use the Fairwater blueprint, rather than to Microsoft's entire global infrastructure estate.

The debate reflects a broader challenge facing the AI industry. Companies, including Microsoft and Google, are racing to build ever-larger AI clusters while facing mounting public pressure to reduce their environmental impact, as communities grow increasingly disapproving of large-scale AI infrastructure projects. Google recently announced a series of water stewardship commitments of its own, including a pledge to replenish more water than its data centers consume by 2030.

Microsoft has unveiled Project Solara, a chip-to-cloud platform designed to power a new generation of "agent-first" enterprise devices — hardware designed to run AI agents instead of traditional apps. Announced at the Microsoft Build 2026 Developer Conference on the 2nd of June, the platform, developed by Microsoft's Applied Sciences Group, features a lightweight edge OS called the Microsoft Device Ecosystem Platform (MDEP). Interestingly, the OS is built on the Android Open Source Project (AOSP) rather than Windows.

MDEP is paired with Azure-hosted agent services and persistent cloud-based state, meaning devices act as interfaces to AI agents running across Microsoft's cloud infrastructure rather than as fully self-contained computers. Together, the software stack forms what Microsoft describes as a chip-to-cloud architecture for enterprise AI devices, combining cloud-hosted agents with centralized security, management, and orchestration capabilities.

"The 'operating system' is liminal, transcending the device and the cloud. The system brings a lightweight window to the edge, where the agent manifests and where the state, via Azure, can encompass a constellation of specialized devices,” explained Steven Bathiche, Microsoft's Corporate Vice President and Technical Fellow in the Applied Sciences Group.

To populate that ecosystem with hardware, Microsoft has partnered with Qualcomm and MediaTek as its first silicon partners — Qualcomm for portable and wearable form factors and MediaTek for stationary devices. The company has no plans to manufacture end products itself. Instead, the company is releasing reference designs for OEMs to build from, alongside an "approved chipsets" requirement that gives Microsoft certification-level control over which hardware qualifies for the platform, similar to Google's GMS certification model for Android.

To demonstrate Solara, Microsoft unveiled two concept reference designs built on the platform. A stationary desk-mounted AI hub built around MediaTek IoT silicon and a wearable AI badge powered by Qualcomm hardware. The desktop companion features a display, a camera, a UWB (ultra-wideband) presence sensor that handles automatic login and lock, dual far-field mics, and two USB-C ports. Connected to an external display, the device can double as a Windows 365 cloud PC client.

Meanwhile, the wearable badge is equipped with a touchscreen, Hello for Business fingerprint sensor, far-field high-SNR microphone array, side-facing camera, and 5G, WiFi, Bluetooth, and GNSS connectivity — targeting front-line workers such as nurses, retail staff, and field workers. Microsoft confirmed that both devices are intended as reference designs for OEM partners rather than retail products.

Central to the platform is what Microsoft calls just-in-time UI — an adaptive interface layer that allows a single agent to render appropriately across different screen sizes and input modalities without requiring developers to rebuild the experience for each device. Microsoft positions this on a spectrum between conventional responsive design and fully generative UI, where AI constructs interfaces dynamically with no predefined structure; Solara currently targets the middle ground, prioritizing consistency while avoiding per-device redesign overhead.

“The same agent can render a custom experience on multiple screen sizes and modalities with little or no additional work from the developer. For us, that is the first proof point: a path to specialized devices without requiring developers to rebuild the experience from scratch each time,” said Bathiche.

Another notable aspect of Solara is Microsoft's decision to build MDEP on Android rather than Windows. AOSP scales naturally to the lightweight, constrained hardware that wearables and embedded devices run on — something Windows, with its memory and processing overhead, was never designed to do. It also sidesteps the application compatibility expectations that come with Windows. Because Solara devices are built around cloud-hosted agents rather than traditional software, Microsoft can optimize the platform for dedicated AI hardware without carrying decades of legacy PC baggage.

To manage multiple agents running simultaneously, Microsoft is also working on an agent dispatcher and agent task manager — components that automatically surface or activate the right agent based on context, rather than requiring users to launch each one manually. Neither component is shipping yet. Early agent integrations include Dragon Copilot for healthcare workflows and GitHub Copilot for developer task tracking — both exploring how persistent, context-aware agents behave differently on dedicated hardware than they do inside a browser or IDE.

The platform appears to be aimed at enterprise buyers in retail, healthcare, and field service sectors, where dedicated agent hardware makes more sense than repurposing a smartphone. Microsoft has already lined up pilots with Best Buy, CVS Health, Levi's, Target, and AccuWeather, with broader OEM deployment targeted across healthcare, hospitality, financial services, legal, and industrial verticals.

The Great Exploitation of 2026 continues apace, with security vulnerabilities being published at an alarming rate, and more often than not, being exploited in the wild almost before anyone has any time to react. Today, Microsoft in the unfortunate limelight, with a 9.8-rated remote execution vulnerability affecting Windows Server domain controllers (DC), versions 2012 to current. The exploit and its explanation are simple: any unauthenticated user in the same network can send a malformed UDP packet to a DC and potentially get system access — no previous access required. Even if an attacker doesn't go that far, it's trivial for anyone to force the DC to reboot, creating potential denial-of-service scenarios.

The vulnerability is CVE-2026-41089, and it's mercifully not a zero-day this time. The vulnerable service is Netlogon, and there's apparently no mitigation, with the only solution being to patch the affected systems. The patch itself arrives in the May 12 Patch Tuesday, but there's a fair chance that a lot of DCs remain unpatched, particularly but not only older versions. Systems administrators might also find specific patch links and remediation scripts handy.

If an attacker can finagle this vulnerability to get System-level of access to domain controllers, the consequences are pretty up to the imagination. The malfeasant can create any number of accounts with all sorts of access levels, including Kerberos Ticket-Granting Tickets, enabling access to most all data across the entire domain. Since DCs often operate as part of a larger network in medium-to-large enterprises, just one vulnerable machine is enough to make the entire network insecure. Cybersecurity boffins recommend that administrators treat this as a worm-style threat and patch all their linked DCs at once, to avoid playing a game of whack-a-mole with high odds for the moles.

Microsoft stated that the vulnerability was not made public at the time, and that no ongoing attacks were using it, but the situation has changed since the discovery date, as recent reports have confirmed that it's now being exploited in the wild. As far as proof-of-concept goes, there's a GitHub repository with some sample code that forces the LSASS service to crash after a minute or so.

The technical details are simple and somewhat facepalm-inducing. The crafted network packet that triggers the vulnerability doesn't have anything all that fancy about it; it just contains one field that's larger than it should be. Data serialization logic in the Netlogon service combines the attacker-supplied data with the server's hostname, resulting in a classic buffer overflow — the most straightforward type of vulnerability.

Microsoft has been in security news quite often recently, mostly thanks to its ongoing spat with security researcher Chaotic Eclipse (aka Nightmare Eclipse), who published a heap of zero-days exploits after apparent negotiations with the company broke down. The situation is unclear, but has escalated to the point where Microsoft is now threatening Eclipse with legal action.

Microsoft has just announced the Surface Laptop Ultra, powered by Nvidia’s latest RTX Spark Superchip for laptops and desktop PCs, at Computex 2026. Claimed to be the most powerful Surface laptop device yet, the new Surface Laptop Ultra is essentially Microsoft’s answer to the current-gen MacBook Pro. The company has positioned the notebook primarily for AI development but also for creators and developers who seek powerful performance in a portable package.

Made in collaboration with Nvidia, the Surface Laptop Ultra will be one of the first devices featuring the RTX Spark Superchip. Nvidia’s new Windows on Arm platform is claimed to be more powerful and capable than any other on the market featuring 20 Arm CPU cores, a Blackwell GPU with 6144 CUDA cores, 128GB of unified LPDDR5X RAM, and up to 300 GB/s of memory bandwidth. The CPU and GPU are interconnected using NVLink C2C, while the large pool of unified memory can be dynamically allocated between the CPU and GPU. Offering up to 1 petaflop of AI compute, the RTX Spark is capable of running up to 120B parameter models locally.

As for the device itself, the new Surface Laptop Ultra will feature a 15-inch mini-LED PixelSense Ultra display with a resolution of 2880 x 1920, offering 262 pixels per inch. Microsoft claims that it can reach up to 2,000 nits of peak HDR brightness, which should be excellent for creators on the go. It also features a large haptic touchpad along with a good selection of ports, including HDMI, USB-C, USB-A, SD card reader, and a headphone jack. Weighing under just 4.5 pounds, it will be available in Platinum (silver) and Nightfall (black) color options. Microsoft claims all-day battery life on the laptop and an optimized internal layout with dual-fans to maintain proper thermals for sustained performance.

The new Microsoft Surface Laptop Ultra is expected to arrive later this year, with final pricing and availability to be announced closer to launch. With the ongoing RAM-apocalypse, it seems like a smart move by Microsoft to adopt Nvidia’s new Arm platform with unified memory. Beyond reducing the need for large pools of dedicated system and graphics memory, the architecture should also help improve efficiency and enable larger AI models to run locally without relying heavily on cloud resources. If Nvidia's performance claims hold up in real-world workloads, the Surface Laptop Ultra could emerge as one of the most compelling Windows alternatives to Apple's MacBook Pro for AI developers, content creators, and power users alike.

Some people are pretty excited that we are on the cusp of a new Windows PC era ignited by technologies from the mighty Nvidia and Arm. Our article on the teasers for the rumored wave of new N1X laptops makes it clear that companies like Nvidia and Microsoft are excited, at least. However, Microsoft veteran Steven Sinofsky is here to remind folks that it has been done before, with a similar level of simmering excitement, when the first Surface hybrid PC ran on Nvidia Tegra Arm silicon back in 2010/11.

Sinofsky shares some interesting media in the above embedded Tweet. There’s a slide from the promotional deck, shown at CES 2011, where the “strong partnerships” behind this Windows on Arm thrust would surely lead to unstoppable momentum. That’s what you may have believed if you swallowed the effusive presentations at the time.

This prior push for Windows on Arm didn’t exclusively support Nvidia Tegra. Sinofsky points out that Windows 8 on Arm also supported Qualcomm and TI processors. However, we saw Microsoft switch to a Qualcomm partnership focus in the years following. That collaborative effort also didn’t break through, even when the much-lauded Nuvia Oryon architecture arrived with the Snapdragon X family.

The former-President of the Windows Division (July 2009 to Nov 2012) also shares a video that should be preserved for posterity. Check it out to witness “an old school Windows Phone video of the first time Windows ran on Nvidia Tegra Arm using the desktop compositor which was a BIG deal. Sept 2010.”

The video appears to show a Tegra dev kit running Windows 7, with multi-window and Start menu manipulation, which looks rather lethargic to my eyes. However, that was a “first” achievement several months before CES 2011, and it would be over a year and a half until the Surface RT shipped to customers (October 2012).

Will the latest Nvidia and Arm thrust into Windows work out better? We’ll probably have a much better idea about that in the coming days at Computex. Sinofsky replies to some comments on his Tweet to say the result could be “a reliable platform for graphics compute,” using Windows. Pricing is also obviously going to be a sticky issue for any new platform looking to attract buyers right now.

Microsoft has uncovered an ongoing cryptojacking campaign that used SEO poisoning and, in some observed cases, AI chatbot-generated software recommendations to lure users into downloading GPU mining malware disguised as popular PC utilities. According to a detailed threat report published Tuesday by Microsoft Defender Experts and the Microsoft Defender Security Research Team, the operation specifically targeted users who likely own high-performance graphics cards, including gamers, hardware enthusiasts, AI users, and overclockers.

The campaign impersonated widely used utilities such as CrystalDiskInfo, HWMonitor, Display Driver Uninstaller (DDU), FurMark, K-Lite Codec Pack, and PDFgear. Victims searching for the software on traditional search engines — and, in some cases, via AI chatbot recommendations — were reportedly redirected to attacker-controlled download pages hosting malicious ZIP archives.

Microsoft says the attackers appear less interested in maximizing infection volume and more focused on compromising systems with powerful discrete GPUs suitable for profitable cryptocurrency mining. Once installed, the malware deployed persistent remote-access software using the legitimate ScreenConnect remote-management tool before silently loading GPU mining payloads such as lolMiner, gminer, and SRBMiner-MULTI.

The attack chain relied heavily on stealth techniques typically associated with more advanced malware operations. The downloaded archives bundled legitimate software installers alongside malicious DLLs that were automatically loaded through DLL sideloading. From there, the malware established six separate persistence mechanisms, added Microsoft Defender exclusions, checked for virtual machines and security-analysis tools, and used process hollowing to inject mining code into trusted Microsoft-signed .NET utilities such as MSBuild.exe, InstallUtil.exe, and RegAsm.exe.

Perhaps the most unusual aspect of the campaign, however, is Microsoft’s observation that some malicious domains may have surfaced through interactions with AI chatbots. According to the company, users requesting software download recommendations from large language model (LLM)-based assistants were, in some cases, presented with links to attacker-controlled domains embedded in generated responses. Microsoft stressed that the example was illustrative and “does not indicate a systemic issue with any specific AI service,” but noted that the activity appears consistent with emerging AI-assisted search-poisoning techniques.

According to Microsoft’s analysis, the operation has been active since at least March 2026 and involved more than 150 malicious domains masquerading as trusted utility-download portals. Many of the downloads were hosted on subdomains of gleeze.com, infrastructure linked to the Dynu dynamic DNS service, which has frequently been used in past phishing and malware campaigns.

The initial infection process itself was deceptively simple. Victims downloaded ZIP archives containing both the legitimate utility executable and a malicious DLL named autorun.dll. When the legitimate application launched, Windows automatically loaded the malicious DLL from the same directory via DLL sideloading — a long-standing Windows abuse technique that requires no software exploit and often produces no visible signs of compromise.

From there, the malware silently installed ScreenConnect, a legitimate enterprise remote-management platform also known as ConnectWise Control. Microsoft emphasized that ScreenConnect itself is not malicious, but rather is being abused by threat actors in the same way attackers increasingly misuse legitimate remote monitoring and management (RMM) tools to evade security scrutiny.

Once remote access was established, attackers deployed a binary called SimpleRunPE.exe, which Microsoft believes may partially derive from a publicly available GitHub proof-of-concept process hollowing project. The malware copied itself into hidden Windows directories as RuntimeHost.exe, created scheduled tasks and startup entries for persistence, and repeatedly re-added Microsoft Defender exclusions even if users or administrators attempted to remove them.

The malware also appeared engineered specifically to avoid detection by performance-conscious PC users. Microsoft says the miner monitored GPU utilization, system idle time, gaming activity, and streaming workloads, shutting down mining operations whenever heavy GPU activity was detected. In practice, this likely reduced obvious warning signs such as sudden frame-rate drops, overheating, or persistently loud GPU fans that might otherwise alert users to a compromise.

To further evade detection, the malware performed extensive anti-analysis checks before activating. The software scanned systems for virtual-machine artifacts, debugging tools, reverse-engineering platforms, packet analyzers, and forensic utilities, including Wireshark, ProcMon, x64dbg, dnSpy, IDA, and Ghidra. If any such tools were detected, the malware terminated itself.

Microsoft says the malware’s operators ultimately used the compromised systems to deploy one of several GPU-focused cryptocurrency miners, including lolMiner, gminer, and SRBMiner-MULTI. Rather than embedding the miners directly into the malware, the payload dynamically downloaded the most appropriate mining software after conducting extensive reconnaissance on the victim system, including GPU model, CPU specifications, installed antivirus software, memory configuration, and overall system activity.

The campaign highlights an alarming development in which attackers are now targeting not only search engines but also AI-assisted discovery systems. While traditional SEO poisoning has existed for years, the growing use of AI chatbots and LLM-powered assistants for software recommendations may be creating a new attack surface where malicious sites gain additional visibility through generated responses. Users need to be extra cautious, as even highly familiar utilities downloaded from seemingly convincing websites may carry hidden malware payloads, particularly when obtained through third-party mirrors or AI-provided links rather than official vendor pages.

Major tech companies are struggling to justify the skyrocketing prices of heavy AI usage, with even major tech firms like Microsoft and Uber looking at changes to their AI process. Following the recent viral post from Uber CTO Praveen Neppalli Naga that the company had blown through its entire 2026 AI budget in just a few months, Uber's Operations chief, Andrew Macdonald, said that token usage just didn't seem to have a direct correlation with useful consumer features.

Microsoft began revoking its developers' access to the Claude Code programming assistant earlier this month, with plans to move them over to the internal Copilot CLI tool by June 30. Although that has been framed as consolidating its teams onto the tools it's developing, it also comes right at the end of Microsoft's fiscal year, suggesting it may have also been a move to cut costs before the new year.

Worsening matters, Goldman Sachs estimates that Agentic AI could see token use increase by over 24 times in just the next few years. There appears to be a growing disconnect between AI needs, AI wants, and the reality of what AI companies can actually afford as costs mount.

Tokens and trade offers

We've been hearing reports for months about how companies and CEOs are struggling to find the tangible benefit of heavy AI deployment. Uber appears to be the latest AI boosting company to have this come to Jesus moment, following the CTO's explosive claims of annual budgets being wiped out in mere months. In the interview with Business Insider, Andrew Macdonald lamented that there just wasn't a clear correlation between the money Uber was investing in AI use and real consumer feature development.

Having talked to the senior engineers, he said there was no link between higher token usage and a proportional increase in consumer features with real benefits for their customers. Although he admitted more code was being shipped, it "was very hard to draw a line" between that and improvements in the software.

Meanwhile, after opening up its workers to Claude Code subscriptions in December last year, Microsoft is now clawing that back in what's seen by many as a financial move, as much as a consolidation. Microsoft also recently announced the switch of Copilot on GitHub to token-based billing, as the cost of running the tool ballooned earlier this year.

A major reason for this is the explosive growth in agentic AI use. These agents can eat up more than 1,000 times the tokens of a single AI chatbot.

Are more tokens really the answer?

Nvidia CEO Jensen Huang famously said in March this year that if an Nvidia engineer on $500,000 a year wasn't using at least $250,000 of tokens in that same period, he'd be alarmed. This isn't a rare sentiment, though. Many company CEOs are now bragging about the extent of their AI use, as if that alone equates to performance increases.

As Business Insider reports, Airbnb's CEO proudly told investors that 60% of the company's code was now AI-generated. Chime claimed it was shipping 84% AI code earlier this year, and even Google is claiming 50% of its code is AI-generated (though crucially, always checked by a human engineer).

Yet these numbers sound very similar to those of Uber. In the CTO's shocking report of budget runaway, they claimed over 80% of Uber software engineers were using agentic AI, and over 60% of the code was AI-generated. Even then, it's not worth the cost.

And those costs can be extreme if the guardrails are removed. OpenClaw creator and now OpenAI employee, Peter Steinberger, recently announced his team of three people had spent over $1.3 million in tokens in a single month running a suite of agentic AI tools.

This very much reinforces the idea that the cost of AI is rising above that of the workers it's supposed to be replacing. That makes many of the layoffs laid at the feet of AI efficiency and productivity increasingly shaky, unless these companies are simply racing to the bottom.

Or at least racing to new hardware. Goldman Sachs' recent AI agent report suggests that the massive efficiency gains coming from next-generation inferencing chips would make AI use so much cheaper that investment can continue unabated, and profit should follow, with AI agents increasing the revenue at AI companies enormously.

Faster, more efficient hardware will take too long

Nvidia will talk up its Vera Rubin platform at Computex and will officially launch it later this year. It improves AI performance by several times over, uses a new process node, and will reportedly offer as much as 10 times the performance per watt, making it dramatically more efficient than its predecessors.

Such huge gains would give the AI companies that first deploy these cards an enormous advantage over the companies still running Blackwell hardware, and even more so over older Hopper designs. But over 50% of the data center projects announced with Blackwell hardware in mind have been cancelled or delayed, and of those that do complete in the next year, just how keen are the developers going to be to replace those GPUs after they've barely gotten started?

In late 2025, Google, Oracle, and Microsoft all adjusted their plans for hardware in the other direction entirely, suggesting they would make it run for six years before replacing it. That seems impossible to square away with ambitious AI plans and hardware leaps every year.

More tokens on less efficient hardware

The reality is, even as some token costs are falling, the explosion in the number of agentic AI requires cannot be offset by hardware efficiency gains that are many years away from reaching effective deployment, if they ever get to the scale needed to catch up with this ramp-up in AI demand.

That means in the short term, even major companies like Microsoft and Uber are restructuring their use of AI to figure out how to continue using it at scale without nuking their budgets in the process. If those companies can't figure out how to afford it, it's increasingly difficult to imagine how the rest of us will be able to.

And if usage drops because of rising costs, the AI companies are never going to find the short-term profit they need to offset the enormous infrastructure spending they're still trying to justify.

There's been some drama unfolding lately in the Windows security world, and today's episode comes from yet another apparent run-in of researcher Nightmare-Eclipse (aka Chaotic Eclipse) against Microsoft. The company saw fit to ban Eclipse's GitHub account for as-of-yet unspecified reasons, forcing them to pack up and move shop to GitLab instead. Additionally, the Redmond firm had allegedly already deleted the Microsoft account Eclipse used for reporting the bugs.

In a blog post, Eclipse claims this action was vindictive, stating once again that Microsoft refused communication attempts and that they "got zero pennies from doing so", a likely allusion to unpaid bug bounties from the MSRC program. The initiative pays out up to $30,000 to $100,000 for per end-point zero-day depending on conditions, and a cool $250,000 if you can crack open Hyper-V. Already having six zero-day exploits under their belt, Eclipse claims that July 14 will bring a reckoning of sorts for the company, hypothetically in the form of more zero-day exploits being published.

Eclipse's dramatic dispute with Microsoft has been ongoing since early April, when they published the BlueHammer zero-day without warning. The language in their blog posts is unclear and passionate, directing cargo tanks of vitriol at Microsoft/MSRC. As a broad summary, Eclipse implies that Microsoft ignored or refused their zero-day reports and/or did not pay out bounties as requested, somehow causing financial harm in the process. Among other statements, Eclipse says "[they were] told personally by [Microsoft] that they will ruin my life and they did", that there's a dead-man switch of some sort, and that they "will make sure [Microsoft's] bones are shattered."

The saga has drawn speculation from other experts, like William Dormann from Tharros, who said that "MSRC used to be quite excellent to work with. But to save money, Microsoft fired the skilled people, leaving flowchart followers. I wouldn't be surprised if Microsoft closed the case after the reporter refused to submit a video of the exploit, since that's apparently an MSRC requirement now."

Microsoft has been mum on any details about these matters, so it's hard to tell if the situation is about an uncooperative researcher who doesn't follow standard disclosure rules or a company being difficult about security reports. Regardless, the move to ban Eclipse's GitHub account makes for poor optics, as it is being heavily criticized, and ultimately achieves nothing for security, since the code is out there anyway.

In this day and age, when AI-powered security research has arguably made the standard 90-day disclosure-to-patch window completely obsolete, and both time-until-exploit and unused exploits are both nearing zero, Microsoft and other software players would do well to adjust their policies.

Eclipse's technical track record is impressive. They published a string of zero-day exploits for Windows: BlueHammer gets access to the SYSTEM user via Defender, and RedSun does the same; UnDefend knocks Defender offline; GreenPlasma gets SYSTEM access via the CTFMon service, while MiniPlasma grants similar access via a flaw in the Windows Cloud Filter driver. Finally, there's YellowKey, a vulnerability in BitLocker that lets an attacker open up encrypted drives with next to no effort — precisely the action the technology was designed to prevent.

BlueHammer, RedSun, and UnDefend have all been confirmed to be undergoing active exploitation in the wild, and it's not hard to imagine the others are as well, as Eclipse's publications of full or partial proof-of-concept code made it trivial for an interested party to use them.

Many tech companies are pushing their employees to use AI tools and increase their productivity, but it seems that this initiative has begun to backfire. According to The Verge, Microsoft has been reportedly pushing its people to switch to its own Copilot CLI rather than Claude Code because it wants to use an internal tool rather than a third-party one. However, sources say the primary reason is that the cost of using Claude Code has been steadily increasing as more people use the AI tool.

Microsoft is not alone in this, as Fortune reports that other companies are also pulling back on AI usage. While it’s true that the cost of training AI models is falling, making AI tokens more affordable, people have started using more tokens in their day-to-day tasks. This is particularly true for agentic AI, which can use a thousand times more tokens compared to querying an LLM, depending on the number of steps needed to accomplish your instructions. For example, OpenClaw creator Peter Steinberger claimed that his team spent more than $1.3 million in token costs in just a single month. Because of this, it’s now apparent that using AI is more expensive than hiring people, especially since it offers only limited productivity gains at the moment.

Decreasing token costs, paired with increased usage, reminds us of the Jevons Paradox, in which increased efficiency has led to more people using a particular tool or technology. There are many examples of this throughout history — the introduction of efficient steam engines during the Industrial Revolution led more firms to deploy these tools to increase productivity. This is also evident in the airline industry: as planes became more fuel-efficient, lower ticket prices led to higher demand, and air travel demand is now on track to double by 2050, according to IATA.

It seems that this is also true with AI tools, especially as many companies are deploying them in a bid to increase productivity. Nvidia CEO Jensen Huang famously said that its engineers should use AI tokens worth at least half their annual salary each year to be fully productive, even going so far as to say, “Are you insane?” to managers who discouraged AI use. This phenomenon, called “tokenmaxxing,” has led many employees to use AI for just about anything to hit internal targets. This was evident at Amazon, where some team members admitted to using the tool for unnecessary tasks to inflate internal usage scores, and it has also been reported at other companies, such as Microsoft and Meta. Incidentally, these companies are among the biggest spenders on AI development.

It’s unclear yet whether these companies will change their policies now that increased token use, which comes with associated costs, has become an issue. AI is indeed a useful tool, but some companies are using it to replace people in a bid to cut labor costs. If the number of tokens needed to accomplish tasks outpaces the speed at which these tokens become cheaper, then that move might just backfire.

Microsoft announced Advanced Shader Delivery (ASD) for Xbox ROG Ally devices last year, bringing precompiled shaders to the handheld to improve load times. Since then, ASD has been included in the DirectX SDK, with both Intel and Nvidia already releasing their own versions of the tech. Today, AMD joins them as Microsoft expands ASD beyond handhelds to RDNA 3, RDNA 3.5, and RDNA 4 GPUs.

Forza Horizon 6 is the latest game to feature ASD on Windows 11 PCs, but you need the Microsoft Store/Xbox PC app version to take advantage of it. Using an RX 7600 GPU and a Ryzen 7 5800 CPU, Advanced Shader Delivery helped the game boot up 95% faster, taking only four seconds to load on first launch. Without ASD enabled, Forza Horizon 6 took nearly a minute and a half to load otherwise.

This is because every time you install a new game or go through an update, the game needs a fresh shader cache, which can take a few minutes to rebuild. Even if you don't touch the game, but your GPU drivers are updated, you need to recompile shaders for all of your games when you open them for the first time. This process is necessary because shader compilation is performed on-device and must account for hardware variability.

Microsoft's solution is to decouple shaders from drivers entirely and place them in a Precompiled Shader Database (PSDB) that lives in the cloud. Every time you download a game from the Microsoft Store or the Xbox PC app, ASD detects your specific configuration (game, GPU, driver) and downloads the precompiled shaders in advance. So, when you open the game, the shaders are already compiled, and you don't have to wait.

Consoles have done this forever, which makes sense considering they don't have to worry about different hardware configs. Even Valve has a version of precompiled shaders for Linux that it developed for the Steam Deck, but never ported to Windows. Since SSDs have made long load times a thing of the past, this has been one of the last remaining hurdles to instantaneous game launches.

Advanced Shader Delivery is available only on RDNA 3 and later GPUs and only on games downloaded via the Xbox PC app or the Microsoft Store. We don't know when other Windows marketplaces will adopt it, but at least 34 other games should support ASD right away, since they were part of the original announcement for the Xbox ROG Ally handhelds.

Moreover, you need to be enrolled in the Xbox Insiders program to get the Xbox Insiders Hub app, which is required to enable Advanced Shader Delivery, since Microsoft is classifying this as a preview. The company worked closely with AMD to develop it, which is why it's limited to RDNA 3+ hardware for now, because otherwise, it's supposed to be a universal solution for all GPUs on Windows 11 going forward.

Regardless, if you have an Nvidia GPU, the Nvidia app should have a feature called "Auto Shader Compilation" that does the same thing. It gives you more granular control over the size of the shader cache, too. If you're rocking an Intel GPU, then check out "Precompiled Shader Distribution" in the Intel Graphics app instead. Intel has implied that it's using its own cloud database for now, with the ASD standard being adopted later this year.

Microsoft has outlined a new feature of Windows called Cloud-Initiated Driver Recovery (CIDR). This newly introduced capability lets Microsoft remotely roll back a bad driver to a previously known good version on affected PCs. Moreover, it can work without user action or OEM intervention. It sounds like a magic bullet for a long history of Windows Update woes, but we’ll have to see if it works when the rubber hits the road. CIDR will only work with drivers distributed via Windows Update.

Windows Update can cause plenty of problems when a bad driver gets through testing and gets pushed to users. Indeed, buggy drivers have caused many a lost hour, gray hair, wrinkle, high blood pressure, and so on, among Windows veterans. Microsoft also notes that a bad driver often means a user has to manually intervene and roll back to “a low-quality driver for an extended period.” So, the new CIDR is cautiously welcomed.

Microsoft spells out the CIDR process in its Tech Community blog, and there we learn that recovery starts by the Windows developer triggering "a recovery action directly from the Hardware Dev Center (HDC) Driver Shiproom." Once a problematic driver is flagged, the system recovers the previously known-good version of a driver via the Windows Update pipeline. “This is handled through coordinated updates to the PnP driver stack and the driver flighting and publishing services,” says Microsoft.

Importantly, Microsoft notes that “recovery is delivered through the existing Windows Update infrastructure — no new client agent or partner tooling is required.” That should help CIDR work well with what we’ve already got and for it to become an established standard. Likewise, partners don’t need to get involved in CIDR, Microsoft will manage it. However, Microsoft asks that these partners “continue monitoring their driver quality metrics in the Hardware Dev Center dashboard and to respond promptly to any shiproom feedback on rejected submissions.”

CIDR is rolling out now for validation and testing, and it is expected to automatically support the Hardware Dev Center publishing process from September onwards.

Amazon is the latest hyperscaler where employees have been caught inflating AI token consumption to hit internal usage targets, following similar behavior documented at Meta and Microsoft last month, the Financial Times reports.

The company set targets requiring more than 80% of its developers to use AI tools each week and tracked consumption on internal leaderboards. Some employees told FT they had been using MeshClaw, an in-house agent platform that can initiate code deployments, triage emails, and interact with Slack to maximize their token numbers. Amazon said usage statistics would not factor into performance evaluations, but multiple employees said they believed managers were monitoring the data. One said there was "so much pressure to use these tools," another described how tracking created "perverse incentives."

The practice — dubbed "tokenmaxxing" — has become widespread enough to generate its own vocabulary and leaderboards, but beyond workplace culture, if a meaningful share of AI consumption is performative, how reliable are the demand figures that hundreds of billions in AI infrastructure procurement are being allocated against?

Combined 2026 capex from Amazon, Microsoft, Alphabet, and Meta is tracking between $650 billion and $700 billion, with some Wall Street projections exceeding $1 trillion for 2027, and every hyperscaler has told investors that inference capacity is being absorbed as fast as it can be deployed. Internal developer consumption is obviously part of that absorption, and it sits alongside paying external customers in the usage data that informs the likes of capacity planning, GPU orders, HBM procurement, and power infrastructure.

Tokenmaxxing doesn’t mean the demand is fabricated — enterprise AI adoption is broadening, and inference workloads are scaling into production — but there’s a distinction between adoption and consumption intensity. The former is a durable driver of demand, whereas the latter is gameable, and it’s currently being amplified by the incentive structures that these companies built. The water is further muddied by reports that AI is more expensive than actual workers.

Meta's internal leaderboard lasted days after public exposure, and Amazon recently restricted visibility of team-wide usage statistics. And when measurement shifts, the consumption intensity they incentivized will shift with them.

Nvidia CEO Jensen Huang has highlighted per-engineer token consumption as a key metric, stating he’d be "deeply alarmed" if a $500,000-a-year engineer was not consuming at least $250,000 in tokens. Nvidia's inference growth obviously depends on that consumption being a productive workload that persists and compounds because every inflated token is real GPU time.

Angie Jones, formerly VP of engineering for AI tools at Block, told LeadDev she expected the industry to pivot toward measuring efficient token usage rather than celebrating volume. In a cycle where GPU orders and power commitments are being placed years in advance, the quality of the demand projections behind them matters. The hyperscalers are building for a world where every knowledge worker consumes hundreds of thousands of dollars in annual compute. Whether that consumption proves productive or performative will determine how much of this year's $700 billion generates durable returns.

Microsoft Threat Intelligence said in an X post on Monday that it is investigating a compromise of the mistralai PyPI package after attackers reportedly injected malicious code that automatically executed on import, downloaded a secondary payload disguised as transformers.pyz, and launched malware on Linux systems — the latest incident researchers believe may be linked to the broader “Mini Shai-Hulud” software supply-chain campaign targeting developer ecosystems.

According to Microsoft, the compromised mistralai package version 2.4.6 contained malicious code inserted into mistralai/client/__init__.py that silently downloaded a file from a remote IP address to /tmp/transformers.pyz and executed it in the background whenever the package was imported on Linux machines.

The filename appears deliberately chosen to resemble Hugging Face’s widely used Transformers AI framework, potentially allowing the malware to blend into machine learning environments and evade suspicion. Microsoft said the second-stage payload functioned primarily as a credential stealer, but also contained country-aware logic and a destructive branch capable of executing rm -rf / under certain geographic conditions. The payload contained logic designed to avoid Russian-language environments, a behavior commonly observed in some cybercriminal malware campaigns, though such checks are not definitive indicators of attribution.

The disclosure comes amid a growing wave of software supply-chain compromises affecting both npm and PyPI ecosystems. Earlier Monday, security firm Aikido warned that malicious package versions tied to the popular TanStack JavaScript ecosystem had been compromised in two separate attack waves beginning around 19:20 UTC. Affected packages reportedly included @tanstack/react-router, @tanstack/history, and @tanstack/router-core, components collectively downloaded tens of millions of times per week.

Hours later, Aikido said several Mistral npm SDK packages had also been compromised as part of the same ongoing “Mini Shai-Hulud” campaign, including @mistralai/mistralai, @mistralai/mistralai-azure, and @mistralai/mistralai-gcp. The firm warned developers to immediately rotate GitHub tokens, npm credentials, cloud API keys, and CI/CD secrets if affected packages had been installed.

Microsoft has not publicly attributed the PyPI compromise to Mini Shai-Hulud. Still, the incidents share several characteristics, including malicious code inserted into trusted packages, staged payload downloads, credential theft, and automatic execution during installation or import. That overlap has raised concerns that attackers are increasingly targeting developer infrastructure itself rather than end users directly.

Modern development environments often contain high-value credentials, including GitHub personal access tokens, cloud deployment keys, SSH credentials, npm publishing tokens, and CI/CD system access. A compromised developer workstation or CI runner can therefore provide attackers with a path into much larger software ecosystems, allowing malicious updates to spread through legitimate package distribution channels.

The behavior observed in the compromised Mistralai package reflects that escalation risk. According to Microsoft’s analysis, the injected code silently used curl to retrieve the secondary payload before launching it as a detached background process designed to continue operating independently of the original Python session. The malware also reportedly suppressed execution errors and limited activity to Linux systems, the dominant operating system across servers, cloud environments, and many AI workloads.

Supply-chain attacks have become an increasingly serious concern across the software industry because of the sheer scale at which trusted dependencies are reused. A single compromised package can rapidly propagate into thousands of downstream applications, enterprise environments, and production systems. Major incidents in recent years have included the SolarWinds breach, the event-stream npm compromise, the 3CX supply-chain attack, and the XZ Utils backdoor attempt.

The latest wave appears particularly notable for simultaneously targeting AI tooling, cloud SDKs, and widely used frontend development frameworks. Researchers believe the campaign’s primary objective is credential theft, potentially allowing attackers to compromise additional packages, maintainer accounts, and publishing infrastructure in a cascading chain of ecosystem infections.

Microsoft advised organizations to isolate affected Linux hosts, block outbound connections to the malicious IP address, hunt for indicators including /tmp/transformers.pyz, pgmonitor.py, and pgsql-monitor.service, and rotate any potentially exposed credentials immediately. The compromises are still under investigation, and additional affected packages may emerge as maintainers and security firms continue auditing publishing infrastructure and compromised credentials.

A $1 billion data center that Microsoft and Abu Dhabi-based AI firm G42 planned to build in Kenya has stalled after the Kenyan government failed to meet Microsoft's demand for guaranteed annual capacity payments, Bloomberg reported Sunday. Kenyan President William Ruto put the scale of the project's power requirements into clear terms at a recent state event in Nairobi, saying the country would need to "switch off half the country" to keep the facility running.

The project, announced in May 2024 during Ruto’s visit to Washington, was supposed to bring a geothermal-powered data center to the Olkaria region in Kenya's Rift Valley. G42 was to lead construction, with the facility running Microsoft Azure in a new East Africa cloud region. The first phase targeted 100 megawatts of capacity and was expected to be operational by this year, with a long-term goal of scaling to 1 gigawatt.

President Ruto isn’t exaggerating about shutting off half the country’s power. Kenya’s total installed electricity capacity sits between 3,000 and 3,200 megawatts, and peak demand reached a record 2,444 megawatts in January, according to data from KenGen, the country’s government-owned electricity producer.

The full 1 gigawatt build would therefore have consumed roughly a third of the country’s total capacity, and even the first 100 megawatts would have required a significant share of the Olkaria geothermal complex's output, which currently generates around 950MW across all its plants.

John Tanui, principal secretary at Kenya's Ministry of Information, told Bloomberg that the project hasn’t been withdrawn and that talks are continuing, adding that the “scale of the data center they [Microsoft] wanted to do still requires some structuring.” A separate 60-megawatt project with local developer EcoCloud is also still under discussion.

Kenya’s Microsoft campus was set to be the first facility that Microsoft and G42 built together after Microsoft invested $1.5 billion in G42 back in 2024. That deal followed G42's agreement to divest from Chinese holdings and strip Huawei equipment from its systems under pressure from Washington. Microsoft President Brad Smith joined G42's board as part of the arrangement and described the Kenya project at the time as the “single biggest step forward” for digital technology in the country's history.

Meanwhile, Huawei is expanding its presence in Kenya, having launched a new fiber broadband service with Safaricom, Kenya’s largest telecom operator, last week. Africa currently hosts roughly 1% of the world's data center capacity.

Microsoft is spending $190 billion on capex in 2026, and the company adds approximately 1 gigawatt of data center capacity every three months globally. But power constraints are proving to be a universal bottleneck: nearly half of planned U.S. data center builds this year have been delayed or canceled due to shortages of electrical infrastructure.

A top Microsoft exec has admitted that Windows 11 still relies on a bunch of old code from the 1990s. It is refreshing for Microsoft Azure Chief Technical Officer Mark Russinovich to highlight this fact on social media, but it might not surprise as many folks as he thinks.

As Russinovich eloquently puts it, those of us invested in the computer scene in the 90s “were thinking flying cars and moon stations by the year 2026, not Win32.” The admission that such old software tech is still the "bedrock" of Windows today may be the CTO strategically sharing a cold, hard truth, providing a 'let's be real' moment as part of Microsoft’s latest charm offensive. Sharing a candid confession indicates that the corporation is actually aware of the issues in its OS.

Remember, the firm is currently in the midst of a major transformation, targeting enthusiast hot button areas like Windows performance, overhead, and reliability. This drastic pivot was cautiously welcomed in contrast to Microsoft being widely slammed for boasting about Windows “evolving into an agentic OS” last November. Currently, Microsoft seems to be flailing around, trying to stop folks straying to pastures greener like Mac and Linux.

However, Win32 isn’t inherently labeled as ‘bad’ by the Microsoft CTO. Though it is ancient, it has probably stuck around for good reason. “I think one of the reasons it’s got this staying power is just a fundamental layer inside of Windows that so many apps have built on,” notes Russinovich. “So many technologies and ecosystems have been built on top of it that it’s kind of a bedrock.”

The CTO explains that Win32 has persisted even when facing targeted existential threats from within Microsoft, particularly in the Windows 8 era. “There’s been various times in Microsoft’s history where we thought we’d reboot the Windows API surface, like WinRT, that actually didn’t play out the way a lot of people expected it to.”

In closing, Russinovich highlights that Win32 was also the bedrock for tools like Sysmon and ZoomIt, which he actually wrote back in 1996. These tools are now “more relevant than ever in 2026,” as parts of Windows 11 and PowerToys, respectively, reckons the CTO.