ArduinoMania

Zoom's automatic update option can help users ensure that they have the latest, safest version of the video conferencing software, which has had multiple privacy and security issues over the years. A Mac security researcher, however, has reported vulnerabilities he found in the tool that attackers could have exploited to gain full control of a victim's computer at this year's DefCon. According to Wired, Patrick Wardle presented two vulnerabilities during the conference. He found the first one in the app's signature check, which certifies the integrity of the update being installed and examines it to make sure that it's a new version of Zoom. In other words, it's in charge of blocking attackers from tricking the automatic update installer into downloading an older and more vulnerable version of the app. 

Wardle discovered that attackers could bypass the signature check by naming their malware file a certain way. And once they're in, they could get root access and control the victim's Mac. The Verge says Wardle disclosed the bug to Zoom back in December 2021, but the fix it rolled out contained another bug. This second vulnerability could have given attackers a way to circumvent the safeguard Zoom set in place to make sure an update delivers the latest version of the app. Wardle reportedly found that it's possible to trick a tool that facilitates Zoom's update distribution into accepting an older version of the video conferencing software. 

Zoom already fixed that flaw, as well, but Wardle found yet another vulnerability, which he has also presented at the conference. He discovered that there's a point in time between the auto-installer's verification of a software package and the actual installation process that allows an attacker to inject malicious code into the update. A downloaded package meant for installation can apparently retain its original read-write permissions allowing any user to modify it. That means even users without root access could swap its contents with malicious code and gain control of the target computer.

The company told The Verge that it's now working on a patch for the new vulnerability Wardle has disclosed. As Wired notes, though, attackers need to have existing access to a user's device to be able to exploit these flaws. Even if there's no immediate danger for most people, Zoom advises users to "keep up to date with the latest version" of the app whenever one comes out. 

The eternal influence of Imogen Heap

Cat Zhang, Pitchfork

Whether it's "the vivid detailing in each song," her "openness to new media and technology" or projects like her Mi.Mu Gloves, Imogen Heap's work has inspired the likes of A$AP Rocky, Taylor Swift and Kacey Musgraves. "Heap’s music sounds like it could be released today, and not simply because the 2000s are trendy again," Zhang writes.

Where does Alex Jones go from here?

Charlie Warzel, The Atlantic

Warzel's Galaxy Brain newsletter makes the cut in our weekly roundup a lot because his writing on technology and related topics is consistently on point. This week, he spoke to an ex-Infowars staffer about the Alex Jones trial, including what that work experience was like and what we can do to hold Jones accountable. 

Elon Musk is convinced he's the future. We need to look beyond him

Paris Marx, Time

"Musk has become the figure everyone was looking for: a powerful man who sold the fantasy that faith in the combined power of technology and the market could change the world without needing a role for the government," Marx writes. "But that collective admiration has only served to bolster an unaccountable and increasingly hostile billionaire. The holes in those future visions, and the dangers of applauding billionaire visionaries, have only become harder to ignore."

If you've been on the lookout for a robot vacuum to help you clean your home, a new sale at Wellbots gives you the chance to pick up some of iRobot's most advanced devices for less. The Roomba j7 and j7+ robo-vacs are both $200 off when you use the code ENGADGET200 at checkout, bringing them down to $399 and $599, respectively. If you want to go all-out, you can also get $200 off the Roomba s9+ using the same code and get it for $799.

Both the j7 series and the s9+ earned spots in our best robot vacuums guide. The j7 models are better for most people because they're cheaper and still have a ton of advanced features. iRobot came out with these models about one year ago and billed them as their first pet poop-detecting robo-vacs. AI-driven computer vision helps these machines navigate around obstacles more efficiently, which means they should be able to avoid any accidents your pets have on your floors. Plus, if they don't avoid the mess, iRobot promises it'll send you a new vacuum to replace your soiled one.

In use, the Roomba j7 cleans both carpeted and hard floors well and it navigates back to its charging base before it runs out of battery. If you go for the j7+, you'll get a clean base as well, which is essentially a garbage can attached to the charging dock into which the robot empties its bin after each job. If you really don't like vacuuming and want to interact with your machine as little as possible, the clean base will come in handy since it can hold up to 60 days worth of debris.

As for the Roomba s9+, it's probably overkill for most people — but it's one of the best robot vacuums available today. It has a sleek design and, since it has 40x the suction power of a standard Roomba, it cleans floors really well and does a good job picking up pet hair. It also returns to its clean base after each job and it'll empty its dustbin automatically. Both it and the j7 series can connect to iRobot's mobile app, allowing you to start cleaning jobs remotely and set schedules and check in on the machine if it gets stuck anywhere in your home. iRobot's app is another major selling point for these devices — it's pretty straight-forward and easy to use, so if it's your first time using a robot vacuum, it won't be too hard to set it up and customize it to your liking.

Follow @EngadgetDeals on Twitter and subscribe to the Engadget Deals newsletter for the latest tech deals and buying advice.

YouTube has been working on an online store where you can purchase subscriptions for various streaming services, according to The Wall Street Journal. The Google-owned video streaming platform has reportedly been developing a "channel store" for at least the past 18 months and is currently in talks with potential partner companies. YouTube already gives its $65-a-month streaming TV subscribers the option to add access to extra services like HBO Max. The upcoming store, however, will apparently give people a way to purchase a la carte streaming services from the main YouTube app.

The Journal says YouTube is pitching its platform as a great way for companies to market their streaming services, since viewers can watch trailers for free on its website or app and then easily pay for a subscription. Partner companies will likely have to share their earnings with YouTube for purchases made within the video platform. YouTube, the publication says, is already discussing how to split subscription revenues with them, though the terms vary for each partner. 

Even with the prospect of having to share revenue with partners, more streaming service are now open to the idea of bundling or teaming up. Starz chief executive Jeffrey Hirsch told The Journal that bundling streaming services with other players creates a better experience for users. Also, it puts providers' offering in front of more people and makes subscribers less likely to cancel. In YouTube's case, the app is already widely used and could provide paying users a single platform to manage several subscriptions. For streaming providers, making their services more readily and easily available could help them survive what analysts believe is going to be a tough year marked with losing a significant number of users.

YouTube's "channel store" could reportedly launch as soon as fall this year, though it has yet to confirm that the project exists and that it's already having talks with potential partners. 

There have been rumblings for a while that a remake of Alone in the Dark was in the works and THQ Nordic confirmed at its summer showcase that the rumors are (sort of) true. It’s bringing a “reimagining” of the 1992 classic to PlayStation 5, Xbox Series X and PC, though didn't reveal when to expect it.

The Lovecraftian original is widely considered the first 3D survival horror game (it earned a Guinness World Record stating as much), but there hasn't been an Alone in the Dark title since 2015. This will also be THQ Nordic's first entry since it bought the series from Atari in 2018.

The single-player reimagining from developer Pieces Interactive will feature an original story from Mikael Hedberg, the writer of Soma and Amnesia: The Dark Descent, and creature designs from long-term Guillermo del Toro collaborator Guy Davis. The game will include characters, places and themes from the ’90s trilogy. It's still set in the American South in the 1920s and features the first game's protagonists, Emily Hartwood and Edward Carnby, as playable characters. However, THQ Nordic says all the enemies will be brand new.

Beyond Alone in the Dark, the publisher had plenty more to show off during the stream, such as fresh looks at SpongeBob SquarePants: The Cosmic Shake, Destroy All Humans! 2 - Reprobed and AEW Fight Forever. Other new reveals included real-time strategy game Tempest Rising; an open-world arcade racer called Wreckreation; and Space for Sale, in which you build homes on procedurally generated planets and sell them to alien clients.

You might not have to pick up your local Facebook Marketplace purchases in the near future. Meta has confirmed to The Wall Street Journal that DoorDash is now handling Facebook Marketplace deliveries as part of an "early" partnership. Couriers will deliver orders that are small enough to fit in a car trunk and come from sellers up to 15 miles away, The Journal's sources said, and should complete their dropoffs within 48 hours.

The feature is currently free to reel in customers, one tipster said. It's not clear how Facebook and DoorDash would charge customers later on. The companies have been testing the offering in multiple US cities in recent months.

The reasoning for the team-up is reportedly simple. Meta has learned that Marketplace is one of the few Facebook features young people use when they're not jumping to TikTok, according to the sources. DoorDash could help spur demand, particularly among younger users.

For DoorDash, the alliance could help reduce its dependence on restaurant orders. The company has already been delivering groceries and convenience store essentials for years. This would give DoorDash a steadier stream of income, and might help it compete with Uber Eats' nationwide shipping service.

The longstanding green car partnership between BMW and Toyota is relatively close to bearing more fruit. As Autoblogexplains, BMW sales chief Pieter Nota told Nikkei in an interview that the brands aim to sell jointly-developed hydrogen fuel cell vehicles as soon as 2025. Nota didn't hint at what to expect, but stressed that fuel cells are "particularly relevant" for large SUVs like the iX5 Hydrogen concept (above). Small-volume production of the iX5 is expected to start by the end of this year.

BMW and Toyota have collaborated on numerous cars over the years, including the recent revival of the Supra sports car. They formalized their green vehicle tech alliance at the start of 2013, but didn't expect to complete work on an inclusive fuel cell system until 2020.

It may seem odd to continue work on hydrogen-powered vehicles at a time when EVs are much more popular. However, Nota pointed to a number of familiar defenses for the technology. Fuel cell cars can be refilled in just a few minutes where EVs take several times longer to recharge, for instance. Nota also said that BMW didn't want to pour all its investments into one technology, and that hydrogen models aren't as prone to supply shortages as their electric counterparts.

Regardless, BMW might soon ramp up EV development. Pure electric cars have represented a larger slice of sales than previously expected, and Nota suggested the company could reach its 50 percent EV sales target (including brands like Mini and Rolls-Royce) "one or two years earlier" than the current 2030 goal. While BMW still has a stake in the combustion engine world, it might not last long.

Try as it might, Hogwarts Legacy developer Avalanche Software can't magically make its creation arrive any sooner. In fact, Warner Bros. Interactive Entertainment has once again delayed the game, which at least now has a firm release date. It will hit PC, PlayStation 4, PS5, Xbox One and Xbox Series X/S on February 10th. The Switch release date will be announced sometime soon, indicating that version faces a further delay.

"The team is excited for you to play, but we need a little more time to deliver the best possible game experience," a tweet on the Hogwarts Legacy Twitter account reads. The game was announced at the tail end of 2020 with a release expected the following year. Warner Bros. pushed back Hogwarts Legacy to 2022 and later said it would arrive sometime this holiday season. However, it has delayed the game once more.

Hogwarts Legacy is an action RPG that takes place in the Harry Potter universe, though it's set long before The Boy Who Lived, well, lived. As a student at Hogwarts School of Witchcraft and Wizardry, you'll craft potions, learn spells, tame wild creatures and (ugh) attend classes. Shockingly enough, you'll need to take what you learned and use it to fend off your enemies.

One thing that will help bolster adoption of cloud gaming is by making it as easy as possible to fire up a game. To that end, Google is testing a way to start playing something with a single click from search results, even if it's not on the company's own Stadia platform.

The test, which was spotted by Bryant Chappel of The Nerf Report, not only enables folks to directly launch a game on Stadia, but it works with Xbox Cloud Gaming, NVIDIA GeForce Now and Amazon Luna as well. If you’re enrolled in the test and search for a game on one of those platforms (such as Destiny 2 or Halo Infinite), you may see a Play button in the information panel. Clicking that will either start up the game or take you to a landing page on the respective streaming platform.

The Verge and 9to5 Google saw the feature in action too. The latter noted the search results can show if a game has a timed trial on Stadia or if it’s available for free or as part of a premium subscription.

It's not incredibly surprising to see Google testing out such functionality. For several years, it has shown folks where they can stream movies and TV shows in search results. For instance, if you have a Netflix subscription and search for Stranger Things on Google, you'll be able to start watching the show with a single click. 

In hindsight, it's a little odd that Google hasn't offered this feature for Stadia from the jump in order to promote its cloud gaming service. On the other hand, Stadia's store didn't have a search function for a year and a half, which offered further evidence that the platform isn't exactly one of Google's highest priorities. However, Stadia is not shutting down and Google is slowly adding more features to it.

It's been a brutal year for Peloton and the company is enacting more major changes in a bid to get back on track. On the consumer front, Peloton is reversing price cuts to two of its core pieces of fitness equipment. The Bike+ is going back up from $1,995 to $2,495 in the US.

The Tread, meanwhile, will be more expensive than before Peloton reduced prices in April to focus on subscription revenues. The Tread will go up by $800 in the US to $3,495. At the start of this year, the machine cost $2,895. The company is also increasing the prices of the products in Canada, the UK, Germany and Australia.

Lowering the prices in the first place “cheapened at least the perception of the brand,” CEO Barry McCarthy told Bloomberg. “So this is a return to historical positioning.” He added that, "I probably wouldn’t have messed with the prices at all if I had been confronted with different inventory states back when we lowered the pricing.” The company isn't changing the price of the original Bike or the Peloton Guide system for now.

Meanwhile, in its third publicly disclosed round of layoffs this year, Peloton is cutting another 784 jobs across its distribution and customer service teams. It will close 16 warehouses in North America and solely use third-party companies for deliveries and setting up equipment in people's homes. Shutting down in-house distribution and closing warehouses will lead to the loss of 532 jobs.

The company will also use third-parties to augment its customer support team, which will be slashed roughly in half with the loss of 252 positions. Those job cuts are on top of around 570 employees Peloton laid off in Taiwan last month as it transitions away from in-house manufacturing. In February, Peloton culled around 2,800 jobs and brought in McCarthy as the new CEO. However, the company still plans to hire in certain areas, such as software development.

On top of all of that, Peloton plans to start closing its retail showrooms next year. It remains to be seen how many will be closed, though it operates 86 in the US and Canada. The company will require office-based workers to return to its offices as of November.

McCarthy told employees in a memo (which was provided to Bloomberg) that changes were necessary to help make the company cash-flow positive once more. “We have to make our revenues stop shrinking and start growing again,” he wrote. “Cash is oxygen. Oxygen is life.”

Peloton posted a huge loss of $757.1 million for the first three months of 2022 due to a decline in revenue and soaring operating costs. It saw a major boom in business soon after the onset of the COVID-19 pandemic. However, it believed that demand would continue after the planet opened back up and it built too many units of its fitness gear before slowing down production earlier this year. 

We'll soon have a clearer picture of the current state of the business. Peloton will post its earnings results for the April-June quarter (Q4 of its fiscal year) on August 25th.