Jess Weatherbed | The Verge

Conversational Gemini navigation comes to Apple CarPlay

2026-10-21T09:01:28-04:00

After introducing its Gemini AI assistant to Android Auto last year, Google is now bringing it to Apple CarPlay users. The conversational Gemini in navigation is available today for US drivers, with “rollout happening globally too,” according to Google (we’ve asked for specific regional availability details).

It’s taken almost 12 months for Google to bring this to CarPlay users, but now they can talk to the voice assistant in Google Maps to get some hands-free help while driving. That includes asking it multi-step questions, such as recommendations on places to visit and then prompting it to direct you there while avoiding toll roads. Users can activate the feature by tapping the Gemini icon in Google Maps on their Car’s infotainment display.

Google describes this CarPlay support update as a conversational way to report traffic disruptions and find information about stops and places on-the-go. There’s no mention of any of the Personal Intelligence features that were announced yesterday for Gemini in Android Auto and cars with Google built-in, however, which enable the voice assistant to access user information from Google apps, including Gmail, Calendar, Maps, Photos, YouTube, and Search. We’ve asked Google if CarPlay users will also receive the personalization update and will update if we hear back.

Blink brings 4K to its low-cost security camera lineup

2026-10-21T10:57:02-04:00

From left to right, here are the Outdoor 2K XR Plus and Mini Pant-Tilt 2K Plus (top), and the Spotlight Cam 2K Plus, Mini 4K Plus, and Frontier XR Plus (bottom). | Image: Amazon / Blink

Amazon is launching a new lineup of Blink security cameras, including its first 4K, pan-tilt models, and battery-powered spotlight models. These new additions provide better resolution and extended range for monitoring your property compared to Blink’s current Mini 2K, Mini 2K Plus, and Outdoor 2K Plus offerings, with a variety of different specializations to best suit your security requirements.

One of the standouts is the $199.99 Blink Frontier XR Plus, a trail camera that’s designed for expansive properties that would typically require multiple cameras or specialized monitoring equipment. It can cover up to 7,000 feet with a clear line of sight, making this Blink’s farthest-reaching camera to date. There’s also the $79.99 Blink Mini 4K Plus, Blink’s first camera to support 4K resolution. It’s suitable for indoor and outdoor use, and features Wi-Fi 6 support, two-way audio, and Smart Alerts with person and vehicle detection.

The $109.99 Spotlight Cam 2K Plus and $49.99 Mini Pan-Tilt 2K Plus are also included in the launch, as Blink’s first battery-powered spotlight and pan-tilt cameras respectively. The Mini Pan-Tilt 2K Plus is the most affordable offering in the new lineup, providing 350-degrees of pan and 115-degrees of tilt alongside night vision, two-way audio, and motion detection for people and vehicles to track where the action is happening.

The $149.99 Blink Outdoor 2K XR Plus rounds out the collection. It can reach up to 800 feet away with some obstructions, or up to 2,700 feet with a clear line of sight. Eligible features like video descriptions, motion-activated notifications, and 60 days of cloud video storage are available as an optional subscription that starts at $3.99 per month, or you can otherwise record locally on a Blink Sync Module.

All five cameras are available for preorder starting today in the US, though availability in other regions will vary by model. Blink hasn’t specified when the cameras will start shipping, so we’ve asked for clarification and will update if we hear back.

A critical PHP vulnerability may take websites down today

2026-10-21T11:46:16-04:00

This PHP issue sounds like a pretty huge problem. | Illustration by Carlo Cadenas / The Verge

Security patches for the PHP programming language, widely used to build websites and web apps, have rolled out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.

The security patch was released today at 10AM ET, and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.

The impact of these vulnerabilities could be vast, with one security researcher estimating that more than 1.3 million internet-connected hosts are likely affected. WordPress security plugin provider Wordfence also warned that every WordPress site will be vulnerable because they all run on servers that use PHP, which is no small number given WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also warned that the fix can’t be installed using automatic updates, so site owners need to find out who is responsible for updating PHP to apply the patch manually.

Post by @Girgias@phpc.social

View on Mastodon

The European Union Computer Emergency Response Team and the UK National Cyber Security Centre have both issued advisories that encourage any companies who can’t immediately patch their platforms to instead isolate their internet-facing apps from public networks or take them offline entirely until the vulnerabilities can be fully mitigated. Mobile operating system developer GrapheneOS says they’ve temporarily taken their user discussion forum offline because proof of concept exploits are already being developed and they “don’t want to take the risk.” According to PHP developer Gina Peter Banyard, patching is the only mitigation, and otherwise turning servers off “might be the most sensible thing to do.”

Multiple cybersecurity organizations have also prompted PHP admins to prepare, with threat researchers at Sansec saying they expect to see “mass attacks within 15 minutes of the release.” That doesn’t mean attackers are waiting around, however. Cloudflare chief technology officer Dane Knecht says “we are seeing early attacks emerging” against the platform’s PHP sites, and that Cloudflare is temporarily updating its firewall rules as a stopgap until the fix is available.

Update, October 21st: Updated language to reflect that the security patches have now been released.

Chrome will now show a warning before you visit ‘suspicious’ sites

2026-10-20T13:09:06-04:00

If you know for sure that a website flagged as suspicious is actually safe, you can mark it as such. | Image: Google

Google is launching a new browser safety feature for Chrome that aims to keep you better informed about how malicious a website might be before you open it. The new suspicious site warnings, available when Chrome’s Enhanced Protection is on, build on a similar two-stage system introduced for Chrome file downloads in 2024, which provides visually different notifications for blocked files based on whether they’re determined to be “suspicious” or “dangerous.”

For the Chrome site warnings, the feature will flag a website as suspicious if it detects that it has similar qualities to other sites associated with phishing, malware, and scams. Google describes this warning as having a “lower confidence verdict” with possible risk of user harm — meaning there’s a chance it could be incorrectly flagged, but you should only proceed to the site if you’re 100 percent confident that it’s safe to do so. The warnings on “dangerous” website have a higher confidence verdict and “high risk of user harm,” however, and should be avoided entirely.

It’s easy to distinguish between these warnings at a glance. The notifications for suspicious websites will appear as a pop-up window on both desktop and mobile, with the webpage visible but darkened underneath, and an option to “Mark as safe” if the site was flagged mistakenly. The already familiar notification for dangerous sites is much harder to ignore: the warning message takes up almost the entire screen and the website will be replaced with a solid red background.

Here’s a comparison between the two warning types on Chrome’s mobile browser. | Image: Google" data-portal-copyright="Image: Google" />

Google also improved Gemini-powered scam detection for Enhanced Protection users, alongside introducing the browser warning redesign.

Update, October 20th: Clarified that the suspicious site warnings appear when Enhanced Protection mode is on.

TikTok employees said they knew about child safety issues, but execs failed to act

2026-10-20T13:33:35-04:00

TikTok was repeatedly warned by its own staffers about risks its platform posed to child safety, according to court records obtained by NPR. The publication reports that employees were frustrated over TikTok executives failing to appropriately act on concerns they raised, including minors bypassing age-restricted content, and appearing in “transactional sexual content” the company could financially benefit from.

The previously unreported depositions of TikTok staffers were filed in federal court in March, and connected to a multi-district litigation initiated in 2022 that brings together hundreds of lawsuits alleging that TikTok, Meta, Snap, and Google knew that they social media platforms are harmful to children, and failed to disclose those risks.

One deposition from Reagen Maher, who held senior safety and investigations positions between 2021 and 2024, described flagging the prevalence of “transactional sexual content” to then-TikTok CEO V Pappas, regarding minors stripping on TikTok’s Live feature in exchange for “gifts” that can be converted into real currency. Forbes reported on the issue in 2022, and Maher said the company was already aware of the sexual exploitation concerns before the article was published.

“I have been fighting about fixing this for months with people who didn’t think the harms are severe enough,” Maher said in an excerpt from an internal chat with a colleague. “Put simply, senior leaders know about this issue. There are some ongoing projects to fix parts of it, and frankly, I’m hoping [that] this article puts a fire behind other potential solutions.”

Another deposition from TikTok’s former head of safety Eric Han says he was concerned about harmful algorithm “rabbit holes” in 2020, describing them as having a “real contagion effect” regarding “suicidal ideation and behavior” in an internal TikTok report. Despite flagging that “minor safety is an urgent issue that we must address effectively,” Han said that TikTok failed to warn parents of the potential dangers of their child using the platform.

Spotify’s new podcast memberships let you pay for extra perks

2026-10-19T06:50:06-04:00

Spotify is enabling podcast creators to earn more money through the platform by providing their fans with a way to pay to access exclusive content. First announced in May, the new Memberships subscription feature is starting to roll out in 34 regions today, allowing podcasters to offer perks including additional content, early access, bonus episodes, and reduced ads behind a paywall.

Users can find Memberships on a podcast’s Spotify page, with the ability to subscribe, pay, and access the exclusive benefits “in just a few taps,” according to Spotify. Podcast creators can set their pricing options and bundle benefits across multiple subscription tiers, and keep 90 percent of membership revenue. Spotify is providing podcasters with tools to analyze and build their Memberships audience, including targeted promotions and free trial offers, alongside community engagement features like member badges, welcome clips, and more.

That makes this more like a Patreon-style membership system in which fans can choose to give additional support to their favorite creators, and is distinct from the podcast subscription feature that Spotify introduced in 2021. Podcasters can utilize Memberships alongside other Spotify revenue streams, including ads and the Spotify Partner Program.

To qualify for Memberships, shows must be hosted on Spotify for Creators or Megaphone, and have at least 100 consumption hours, 100 listeners or viewers, and three published episodes. Spotify is also making it easy for podcasters who manage their subscriptions on other services to try Memberships, allowing them to bring their paywalled content to Spotify via its Open Access feature.

Some Google Home Speakers caught downloading hundreds of gigs of data

2026-10-20T06:16:47-04:00

Google says a fix is rolling out that should solve the issue. | Photo: Jennifer Patison Tuohy / The Verge

Some Google Home Speaker owners are currently experiencing an issue in which hundreds of gigabytes of data are being continuously downloaded to their device in the background. The bug, reported by 9to5Google and several Reddit users over the last week, may be caused by the speakers failing to correctly download and install a firmware update, with one Redditor finding that his device was consuming more than 200GB per day.

Thankfully, Google is aware of the issue. In a statement to 9to5Google, the company said that “a fix is already rolling out that should address this for users.” Most of the reports are tied specifically to the new Google Home Speaker model, but it isn’t clear how widespread the issue is. We’ve reached out to Google to request more information about the cause and confirm impacted devices.

My colleague Tom Warren confirmed that his own speaker is unaffected, and 9to5Google reports another Home Speaker in a different household downloaded just 2GB in the past month, compared to to 132GB used by an impacted device over the same period. A big concern for anyone with a limited data plan here is that the bug could quickly eat through the allotted limit, and they wouldn’t know unless they regularly check to see how much data their devices are using.

Amazon is funding a new nuclear plant in Indiana

2026-10-19T11:44:20-04:00

It’ll be several years before the facility is complete, but this digital rendering gives us some idea of what it’ll look like. | Image: Amazon

Amazon has signed an agreement with X-energy and American Electric Power (AEP) to fund the building of a new nuclear energy facility in Indiana. The proposed plant, which would replace the now defunct coal-fueled Breed Generating Station in Fairbanks, Sullivan County, aims to provide up to 960 megawatts of carbon-free energy for both the regional power grid and Amazon’s data centers.

No timeline for construction or operation has been announced for the facility, which Amazon says “could” create 1,000 construction jobs and 100 permanent roles. The facility in Indiana is targeting to build 12 Xe-100 SMR’s, an advanced (but unproven) reactor that’s still undergoing development and licensing. These reactors can be cooled using either air, water, or a hybrid solution of both, which Amazon says should allow them to be deployed in water-constrained regions without impacting water demand in local communities.

Indiana also happens to be home to a famously expensive and uncompleted energy project called the Marble Hill Nuclear Power Plant. It was abandoned half-finished in 1983 after $2.5 billion had already been sunk into it, and has been under continued demolition since 2008. Terms for Amazon’s agreement in Fairbanks haven’t been disclosed, so we can’t compare the cost between the facilities.

This marks the second nuclear energy project that Amazon and X-energy are collaborating on, with the collective goal of working with regional utilities to deploy more than 5 gigawatts of new nuclear capacity in the US by 2039. In October last year, Amazon shared an early preview of its first planned nuclear plant, the Cascade Advanced Energy Facility in Washington. That project is similarly set to build 12 advanced reactors and create local jobs, but construction isn’t expected to start until the end of this decade.

Amazon is one of several tech companies, including Meta, Microsoft, and Google, that are exploring their own nuclear energy projects to power AI data centers. Investing in energy grid infrastructure was also one of the commitments that Amazon outlined in a lengthy blog post earlier this month that aimed to sway some of the growing negativity around data center projects, though it’ll be many years before anyone — including Amazon — can reap the benefits of these new facilities.

Time is a-changin’: say goodbye to the leap second

2026-10-16T06:00:25-04:00

An important change will soon be made to global timekeeping that aims to prevent potential infrastructure failures akin to the Y2K bug scare. On Thursday, the International Bureau of Weights and Measures (BIPM) voted to scrap the leap second, an ad hoc time adjustment that’s occasionally added so tracked time standards mirror the Earth’s real (and inconsistent) rotation.

BIPM members previously agreed in 2022 to cease using leap seconds on or before 2035, but this is now being expedited to take effect on May 20th next year, aligning with World Metrology Day. There’s an unprecedented reason for its retirement being brought forward: changes to the Earth’s rotation may soon require timekeepers to subtract time instead of adding it in order to keep astronomical time in line with atomic time. This has never been attempted before, and there are concerns that doing so could wreak havoc on critical infrastructure that relies on time synchronization.

Those fears aren’t unfounded given Foursquare, Reddit, LinkedIn, Yelp, and many other tech platforms have suffered outages in the past when leap seconds have been added. Companies including Meta, Google, Microsoft, and Amazon have all supported efforts to scrap the system. Following the BIPM vote, timekeepers will instead switch to using “leap hours,” allowing atomic and astronomical time to gradually drift apart until an entire hour needs to be added — which isn’t expected to happen for around 3,000 years.

Microsoft’s new Photos app combines your PC, OneDrive, and iCloud galleries

2026-10-15T10:53:38-04:00

Link your image libraries together into one easy browsing gallery. | Image: Microsoft

Microsoft has redesigned its Photos app for Windows 11, overhauling the editor and image viewer, and combining photos and videos from your PC, OneDrive, and iCloud into a single space. The new combined gallery experience aims to make it easier to manage and view your photos without jumping between apps or devices, while also improving app launch and scrolling performance in Photos.

To combine your galleries in the Windows 11 Photos app, you’ll need to turn on Camera Backup in the OneDrive mobile app on iOS or Android, and follow Apple’s guide to set up iCloud for Windows. Once combined in the Windows 11 Photos app, you can browse by date, organize and share albums, search for specific photos via descriptions or by the people featured in them, and more. You can browse files online or offline, and Microsoft says photos will be available on your device “even when you’re not connected.”

The new Photos editor has been “rebuilt from the ground up,” according to Microsoft, launching 25 percent faster and arranging tools into four categories: Crop, Enhance, Repair, and Stylize. The Photos app now also preserves HDR quality during editing processes and allows you to edit and save HEIC and WebP images without altering their original format.

Here’s an example of the tools you’ll find under the new “Crop” category. | Image: Microsoft" data-portal-copyright="Image: Microsoft" />

Lastly, the viewer has been given a cleaner layout and performance enhancements, launching 15 percent faster and opening HEIC images up to 30 percent faster, according to Microsoft’s announcement. Media type support has also expanded to SVG files. These new Photos experiences are rolling out today as an update for Windows Insiders on Windows 11, with Microsoft expecting a full launch for all Windows 11 users later this year.