The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers actively exploiting flaws in Ubiquity UniFi OS and Lantronix serial-to-ethernet servers. [...]
Microsoft, Europol, and international partners have disrupted infrastructure used by the Amadey and StealC malware operations as part of Operation Endgame, which targets cybercriminal services and ransomware gangs. [...]
Service desks have become a favored target for attackers seeking password resets, MFA changes, and access to corporate accounts. Specops Software breaks down how service desk social engineering attacks work and how organizations can defend against them. [...]
Past breach data show over 1.1 million soccer-related passwords
ExpressVPN found that nearly 1 in 4 football fans use this info in their logins
Experts urge to delete any sports references from account logins' details
As the FIFA World Cup kicks into high gear, millions of fans are displaying their loyalty online. While you might already be using the best VPN to secure your browsing, ExpressVPN — now an official supporter of the 2026 tournament — is warning that this very public fandom can translate into a major cybersecurity vulnerability.
In a new research report, cybersecurity researcher Jeremiah Fowler partnered with ExpressVPN to examine how soccer obsession influences our password choices. The results suggest that fans are openly handing hackers the keys to their digital lives by using highly predictable phrases.
Fowler's analysis of historical data breaches revealed more than 1.1 million soccer-related passwords. Words like "soccer," alongside massive club names such as "Liverpool," "Chelsea," "Arsenal," and "Barcelona," appeared repeatedly throughout the dataset.
Because fan loyalty is incredibly public, plastered across social media profiles, usernames, and group chats, these passwords are far easier to crack than a random string of characters.
"As a cybersecurity researcher, I've seen criminals target people through the interests they share most openly," Fowler explained. "A club name, player nickname, shirt number, stadium, city, or tournament year may look harmless on its own, but together those details can help someone guess how a fan might build a password or craft a message they're more likely to trust."
An open goal for cybercriminals
(Image credit: ExpressVPN)
To determine if this behavior remains common today, ExpressVPN surveyed 6,000 football fans across six countries. The findings confirm that bad password hygiene is still widespread.
Nearly one in four surveyed fans admitted to having used soccer-related information to secure an account.
Among these fans, the most common choices included their favorite team names, player names or nicknames, and jersey numbers. These easily searchable statistics are exactly what malicious actors look for when compiling custom dictionaries to breach an account.
The fans themselves are surprisingly aware of the risk. In the US, a massive 73.1% of those using soccer-themed passwords acknowledged that someone familiar with their sporting interests could likely guess their login.
Using a weak password becomes catastrophic when you consider password reuse. According to Aaron Engel, Chief Information Security Officer at ExpressVPN, the habit of using the same login across multiple services is what turns a minor breach into a full-scale privacy crisis.
"Password reuse is what allows one exposed credential to become a wider account-security problem," warned Engel.
He also noted that fans who share streaming logins put their personal data in further jeopardy: "Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own."
If you want to stay safe while streaming the tournament, you should immediately strip any sports references out of your logins. Instead, use a dedicated password manager to generate complex, unique credentials for every account.
IO research shows 87% of UK cybersecurity managers doubt the credibility of speed‑focused certification programs
Rapid, automated compliance creates a false sense of security, with certifications like ISO 27001 not guaranteeing resilience
Experts stress continuous monitoring and human oversight, as automated recommendations and evidence still need validation and interpretation
Speed-focused compliance programs could help businesses get cybersecurity certifications quicker, but security professionals are skeptical if the speed comes at the expense of actual business resilience.
This is according to new research from resilience specialists IO, which claims that 87% of senior cybersecurity managers in the UK believe the speed at which certification is achieved affects its credibility.
According to the report, compliance initiatives that are either heavily automated or compressed into short timeframes are creating a false sense of security. Certifications like ISO 27001 might help companies win contracts and maintain an image, but researchers are warning that certification alone does not guarantee actual operational resilience.
Gaps in security posture
“Organizations that focus on achieving certification as quickly as possible are at risk of leaving gaps in their security posture,” says Chris Newton-Smith, CEO of IO. “Certification can open doors to new contracts and demonstrate commitment to recognised standards but treating certification as the end goal rather than the outcome of establishing and embedding effective compliance is more often than not at the expense of long-term resilience. Businesses must treat compliance not as a tick-box exercise but an evolving, iterative, and business critical project.”
Polling 251 cybersecurity managers in the UK, IO found that 31% consider continuous controls monitoring as the strongest indicator of compliance resilience. At the same time, a fifth (21%) said certifications could reflect security controls at the time of an audit, but could soon after become obsolete.
IO also stressed the importance of human expertise in these programs. Almost half (45%) of the respondents said human involvement is still essential when evaluating if automated compliance recommendations are still relevant and accurate, and another third (33%) said complex regulations still need human interpretation.
Finally, 32% stressed the importance of human in validating compliance evidence generated by automated systems.
Huntress report highlights “EvilTokens” PhaaS scaling phishing attacks 1,380% in early 2026 compared to last year
AI integration enables per‑victim personalization at scale, bypassing MFA, with subscription tiers from $600 to $1,500
Service sold openly on Telegram, showing how PhaaS now operates like a startup with cheap, powerful attack capabilities
Cybercriminals offering phishing-as-a-service (PhaaS) are increasingly operating like a tech startup, and a good one, at that. They are also using Artificial Intelligence (AI), which helped them scale significantly. This is according to a new report from cybersecurity researchers Huntress, called “EvilTokens and the Rise of AI-Powered Phishing”.
In the report, Huntress claims that this particular PhaaS operation, called EvilTokens, was used to run 1,380% more phishing attacks in early 2026 compared to the same period last year.
“We’re seeing a clear maturation of the phishing-as-a-service (PhaaS) market as threat actors increasingly integrate AI workflows into their product offerings,” the report reads. “The result is directly observable in our telemetry: a 1,380% increase in device code phishing attacks detected between July–December 2025 and January–April 2026, with over 50% of those incidents linked to two major waves of correlated incidents.”
A cheap service
“Furthermore, across hundreds of incidents associated with EvilTokens, no two phishing lures were identical. This level of per-victim personalization was previously limited to targeted, manually crafted campaigns. Now, it’s achievable at scale by any threat actor at the price of a subscription service”
So, AI is not only used to scale the operation, but it is also used for personalization at an unprecedented level. At the same time, the service is relatively cheap to use: it is being sold on Telegram for as little as $600.
If this sounds like a lot, keep in mind that a single successful phishing attack is enough to steal data worth hundreds of thousands on the black market, or even millions - in ransom negotiations.
EvilTokens’ service is tiered, too. The cheapest package costs $600, while two more expensive ones cost $1,000 and $1,500, respectively. For criminals, it is likely worth the investment, since this PhaaS is capable of bypassing multi-factor authentication, as well.
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. [...]
LastPass confirmed a supply chain breach via Klue, where stolen OAuth tokens let attackers access its Salesforce environment
Customer names, contact details, and CRM data were exposed, but master passwords were not; phishing risk remains high
Threat actor Icarus claimed responsibility; other firms including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity also impacted
Password manager LastPass confirmed that it lost sensitive customer data in a supply chain attack that struck a third party.
As LastPass explained in a newly released incident report, unnamed threat actors first targeted Klue, a third-party market intelligence platform that integrates with its Salesforce and Gong systems. After obtaining its OAuth tokens, the attackers were able to access LastPass’ Salesforce environment and exfiltrate sensitive data stored there.
“On June 12th, LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams, which integrates with our Salesforce and Gong systems,” LastPass said.
Compromising names and emails
"We immediately launched an investigation and learned that, as part of this incident, an unauthorized actor was able to obtain OAuth tokens Klue held for many of its customers, including LastPass.”
“The threat actor then used these credentials to access LastPass customer data within our Salesforce environment.”
Further in the report, the password manager said the attackers most likely accessed customer names, phone numbers, email addresses, postal addresses, support case information, and sales/CRM-related data.
Passwords, including the master password, were most likely not exposed. However, criminals can use the data they obtained to launch phishing attacks, through which they might trick the victims into sharing those secrets, as well.
LastPass is now urging customers to remain vigilant and be careful with incoming messages, particularly those claiming to come from the company.
According to BleepingComputer, the Klue supply chain attack was claimed by a threat actor called Icarus, which apparently used compromised legacy credentials for an integration service to breach the intelligence platform.
Besides LastPass, a number of other organizations are affected as well, the publication further reported, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity. LastPass has now disabled employee access to Klue.
Traveling to the 2026 World Cup means joining hundreds of thousands of fans in crowded cities across North America.
Airports, stadiums, fan zones, and hotels are all packed with people competing for the same public Wi-Fi networks. These connections are often slow and insecure, making personal data vulnerable to interception.
To stay protected without sacrificing speed, you need more than just a VPN – you need the best VPN with the right settings. Tuning your VPN configuration helps keep your connection secure and fast, no matter where you go during this summer’s tournament.
The 5 best settings to change for top VPN performance
Just turning on your VPN isn’t always enough to cut through the noise of a packed stadium or busy airport terminal. To get good speeds and real security when thousands of people are online at once, here are five specific settings to tweak:
1. Protocol
WireGuard is the superior protocol choice for modern devices, offering faster connection speeds and lower latency compared to OpenVPN or IKEv2.
This efficiency matters when network congestion is high. WireGuard establishes secure tunnels more quickly, reducing wait times. If your provider offers OpenVPN, it's a great alternative for compatibility, but for raw performance in crowded zones, WireGuard is best.
2. Transport protocol
If you've never heard of transport protocols before, think of them as the delivery method your VPN uses to move data. Most commonly, you'll see TCP and UDP as your choices for this.
On congested networks, TCP’s reliability mechanisms can add delay when packets are lost. UDP avoids this overhead by sending data without waiting for confirmation.
In a crowded stadium where every millisecond counts, switching to UDP can reduce latency and improve responsiveness for smooth VPN streaming even when the network is struggling to keep up.
3. Split tunnelling
With split tunneling, you can choose which apps can be routed outside the VPN’s encrypted tunnel. At a stadium, your banking app needs maximum security, but a local map app might benefit from direct access to avoid unnecessary latency.
Excluding non-sensitive apps from encryption can reduce bandwidth strain and prevent compatibility issues with local networks that sometimes block VPN traffic entirely.
4. Location
Connecting to the server closest to your physical location often results in lower ping and faster speeds. However, nearby servers may be overwhelmed by thousands of users connecting simultaneously.
If your current location lags, try switching to a server slightly further away that’s under less user load. Avoid jumping between regions unnecessarily, as crossing international borders increases the distance data travels and introduces lag that ruins live streaming.
5. Obfuscation
In monitored environments like airports, deep packet inspection can detect and block standard VPN traffic.
Obfuscation disguises VPN traffic as regular HTTPS web traffic, allowing you to bypass firewalls and censorship attempts. Although this adds processing that might marginally impact speed, the ability to stay connected when other connections fail more than makes up for this.
Norton VPN handles 2026 World Cup crowds well. With servers in over two dozen North American cities, it’s designed for high traffic. It features native WireGuard support and built-in obfuscation to bypass congestion and blocks. Plus, a generous 60-day money-back guarantee gives you plenty of risk-free time to test these tweaks.View Deal
As you prepare to cheer on your national team at the 2026 FIFA World Cup, make sure your setup can handle the packed stadiums and busy airports.
By selecting the right VPN protocol, using UDP, and enabling features like split tunneling, you can protect your data and keep your device safe so you can enjoy the World Cup worry-free..
An extensive program at Meta to gather a wide range of data from employees to train its AI model has been frozen after employees reportedly broke through its guardrails and accessed restricted data, and then did so again after Meta claimed to have fixed the vulnerability.
Whether or not the data collection by the $201 billion owner of Facebook was a good idea, analysts argue that the data protections deployed were woefully inadequate, given the extreme sensitive nature of the collected data.
“Meta had the resources to get it right, and yet they failed exponentially,” said Karianne Michelle, a director with consulting firm Acceligence. “That is what it looks like when the policy decision and the technical execution are happening in two different rooms that are not fully in sync. It is the kind of gap you see often enough at organizations under structural strain.”
Fritz Jean-Louis, principal cybersecurity advisor at Info-Tech Research Group, agreed.
“What we just observed from the Meta story is a classic failure mode in AI-era data strategy: collecting high-risk telemetry without equally mature access controls,” Jean-Louis said. “At that scale, a single misconfiguration turns internal data into a systemic exposure.”
The story, detailed in a Wired report, involved a program that Meta rolled out in April called the Model Compatibility Initiative (MCI), which collects computer inputs such as mouse movements, click locations, and keystrokes, as well as screen content, the story said. Meta employees were initially not allowed to opt out.
The data collected included full prompts and transcriptions, private conversations, people and performance data, Wired said, adding, “Meta executives have repeatedly defended the data-gathering project, saying it was necessary to train AI systems to operate computer software the way humans do, and that employees were the best examples for the artificial intelligence to learn from.”
Wired also quoted Stephane Kasriel, a Meta vice president overseeing AI research, who saying that the company discovered that unauthorized employees were found to have accessed MCI data on June 18, and that the hole was closed “within four hours.” But, he added, “ the initial fix didn’t stick, and access to the data had to be further locked down.”
In an email statement, Meta confirmed that the program was being halted for the time being. “We have carefully designed this program with privacy safeguards, and while we have no indication at this time that any data was improperly accessed by Meta employees, we’re pausing it while we investigate,” Meta said.
A ‘liability surface’
Analysts, consultants, and industry practitioners said they were more concerned about the inadequate protections than the underlying data exposure.
Carmi Levy, an independent technology analyst, said that although there should be concerns about Meta’s “Orwellian oversight of workers’ keystrokes and mouse movements,” the bigger issue is the paper-thin protections that it used to protect that data.
“As creepy as MCI was and is, the reason Meta has hit the pause button has nothing to do with the moral and ethical fuzziness of everyday employee surveillance, and everything to do with its failure to secure the data it collected in the process,” Levy said. “Conceivably, it will resume monitoring and data collection once it fully understands how highly sensitive data, such as employees’ private conversations, performance data, and transcriptions, ended up being inadvertently shared with the entire workforce.”
One of the critical background issues is that while the data collected was highly sensitive, it was not, from a strict compliance law perspective, PII (personally identifiable information). That distinction might have lulled Meta into a false sense of security and convinced it that the data did not merit strong protections.
“I think companies can get a little too comfortable saying, ‘Well, it’s not PII,’ as if that makes the data low-risk,” said Tom Findling, CEO of Conifers.ai. “But internal prompts, transcripts, chats, data tables, and performance notes can tell you a lot about how a company works, what it’s building and where things are messy or exposed. That’s sensitive, even if it’s not someone’s Social Security number.”
Findling argued that Meta executives “wanted to pretend that they didn’t understand” how sensitive the collected data was, and that was their excuse for why they should not have to protect it sufficiently. “There is no doubt that Meta did not tag this at an appropriate risk level,” he said.
Info-Tech’s Jean-Louis took particular umbrage at the particulars of the collected data.
“Employee behavioral data, such as keystrokes, screenshots, and usage patterns, is effectively sensitive by default. If you’re using it to train AI, you have to treat it like production secrets, not analytics exhaust,” Jean-Louis said. “When thousands of internal tables are broadly accessible, you have a liability surface rather than a data platform. Trust nowadays is a security control. Once employees believe their data is overcollected or underprotected, you introduce both insider risk and reputational damage at the same time.”
“The data Meta exposed is not the real risk. Security policy only works if people believe it, and belief is exactly what is now in question,” Michelle said. “That gap is where incidents like this one do their damage: once employees stop trusting what leadership says about their own data, the doubt follows every policy that comes next, producing workarounds, quiet noncompliance, and employees who stop raising flags.”
Airbnb scams have surged 30x since 2023, including a sharp rise this year
Criminals hijack legitimate host accounts to to trick holidaymakers
Staying safe isn't so straightforward as threats evolve
Airbnb-related scam activity has increased 30x since the first half of 2023, according to new research from Saily and NordStellar, confirming that cybercriminals continue to go after holidaymakers seeking the best deals amid rising prices.
The report ultimately concludes that attackers are now targeting the trust built by larger platforms, saving them from having to build new identities from scratch.
And to top it all off, the nature of scams is also changing, as instead of using suspicious websites to obtain victim payments or information, criminals are now targeting legitimate Airbnb host accounts which have spent years amassing positive reviews and high ratings.
Exploiting legitimate accounts and hijacking trust
While the end goal remains high volumes of vulnerable consumers, scammers have added an extra layer of victim in their pipeline. Verified Airbnb hosts are now valuable assets for criminals because they already have identity verifications, positive reviews, booking histories, years of activity and established credibility.
Once the verified account is compromised, attackers can then go on to scam higher volumes of unsuspecting victims by posting – and charging for – fake property listings.
“Travelers are getting better at spotting obvious scams,” Saily Head of Product Matas Cenys said. “Criminals know this, so they are increasingly trying to steal trust instead of building fake trust from scratch.”
Where this type of attack differs from others, though, is that the victims never leave the platform. Rather than falling victim to phishing attacks and being redirected to malicious external sites, they interact fully with supposed legitimate hosts on the Airbnb platform.
While Airbnb attacks have seen a 30x increase in around three years and a sharp rise in the last year alone, they reflect a much broader trend of attackers compromising existing trusted accounts.
The recent ramp-up in attacks could also be tied to the summer season, with holidaymakers looking to book last-minute deals in the run-up to the summer season. Urgency and pressure to keep costs low also adds to criminals’ success.
“Everything looks normal until they arrive at their destination and discover the accommodation never existed," Cenys added.
How to protect yourself from booking scams
Saily is recommending that all communication stays within the booking platform and that customers avoid payment methods suggested outside of official channels. Unusually attractive listings in high-demand destinations could also be taken with a pinch of salt, and savvy shoppers may choose to reverse image search a property to double check its authenticity.
“As travel booking becomes increasingly digital, trust becomes one of the most valuable currencies in the travel ecosystem,” Cenys warned.
As for abusing victim trust, researchers also argue that AI has aided attacks by allowing criminals to produce better fake listings more quickly.
More generally, Airbnb revealed that two in five Americans have fallen victim for an online scam, with the average loss totalling nearly $2,000. The company has introduced measures to remind its users how to avoid scams, including introducing identity verification and reminders not to leave the platform, but account takeovers can still slip under the radar.
Airbnb also holds guest payments until 24 hours after check-in to ensure that everything is as described. Anti-fraud tech also prevented around 265,000 suspicious listings from appearing on the platform in 2025, the company boasted.
The company posted a comprehensive eight-step list of how to avoid scams on its platform online, calling out pressure tactics and unusual deals.
A 29-year-old bug in the Squid web proxy, dubbed Squidbleed and tracked as CVE-2026-47729, can let an authorized proxy user retrieve fragments of another user's cleartext HTTP requests, including credentials and session tokens. The security researcher who reported the flaw credited Anthropic's Claude Mythos Preview for the discovery. The Hacker News reports: Squid describes this as an attack by a trusted client: someone already permitted to use the proxy, not any random host on the internet. That matches Squid's usual home, shared networks like schools, offices, and public Wi-Fi. In those setups, the attacker is just another user of the same proxy. The leak also only reaches traffic that Squid can read. Normal HTTPS rides an opaque CONNECT tunnel, so Squid never sees inside it; the exposed traffic is cleartext HTTP, plus TLS-terminating setups where Squid decrypts and inspects. The attacker also needs the proxy to reach an FTP server they control on port 21. Both FTP and that port are on by default.
[...] If you patch, verify the fix, not just the version. Confirm the guard is in FtpGateway.cc, or check your distribution's backport, since distros ship their own builds (Debian packages Squid 5.7). The public thread is still inconsistent: maintainer Amos Jeffries first said Squid 7.6 carried the fix, then corrected that to 7.7, and on June 22 Debian's Salvatore Bonaccorso noted the referenced commit looks like it is already in 7.6. The fix is small, a null-terminator check before the vulnerable strchr calls, merged to the development branch in April and v7 in May. Squid 7.6 does separately patch CVE-2026-50012, an unrelated cache_digest heap overflow.
The cleaner move is the one the researchers recommend anyway: turn FTP off. Chromium dropped FTP years ago, and most networks carry almost none of it, so disabling it removes this attack surface for free, whatever build you run. The risk is real but bounded. SUSE rates it moderate, CVSS 6.5, and the vector explains the score: the attacker needs proxy access (low privileges), and the only impact is confidentiality, nothing on integrity or availability.
The White House is drastically shortening the deadline for government agencies and organizations to adopt new quantum-resistant encryption systems that will withstand attacks that use quantum computers, as the federal government seeks to protect decades’ worth of secrets belonging to militaries, banks, governments, and most individuals on Earth.
The executive order, titled Securing the Nation against Advanced Cryptographic Attacks, requires computing systems for “high-value assets” and “high-impact systems” to transition to post-quantum cryptographic key establishment schemes by December 31, 2030, and to quantum-safe digital signature schemes by December 31, 2031.
Heading off a significant threat
The new deadline, which for many organizations is about five years sooner than the previous one, comes on the heels of recent research showing that the resources and cost for building a cryptographically relevant quantum computer are far less than previous consensus estimates. In response, Google, Cloudflare, and other companies recently tightened their timelines for moving off vulnerable systems to 2029.
The White House is drastically shortening the deadline for government agencies and organizations to adopt new quantum-resistant encryption systems that will withstand attacks that use quantum computers, as the federal government seeks to protect decades’ worth of secrets belonging to militaries, banks, governments, and most individuals on Earth.
The executive order, titled Securing the Nation against Advanced Cryptographic Attacks, requires computing systems for “high-value assets” and “high-impact systems” to transition to post-quantum cryptographic key establishment schemes by December 31, 2030, and to quantum-safe digital signature schemes by December 31, 2031.
Heading off a significant threat
The new deadline, which for many organizations is about five years sooner than the previous one, comes on the heels of recent research showing that the resources and cost for building a cryptographically relevant quantum computer are far less than previous consensus estimates. In response, Google, Cloudflare, and other companies recently tightened their timelines for moving off vulnerable systems to 2029.
Ring video doorbells always get deep discounts for Amazon Prime Day, but the savings might not be quite as impressive as they first seem. Although the up-front cost might be low, you'll need a Ring Home subscription to get the most out of your new purchase, and that can really add up over the years. That's not the case with all video doorbells, though, and here I've rounded up my top five picks that give you full functionality without the monthly fees.
The key is that all the video doorbells here let you store videos on a microSD card. Some brands offer cloud storage if you really want it, but it's definitely not necessary. Some doorbells (like the EZVIZ EP4 I'm testing right now) also include newer features like facial recognition that you'd usually expect to be part of a paid membership plan.
All of these doorbells have been tested, reviewed, and given the seal of approval by our team of home tech experts, so you can be confident you're making the right choice.
Eufy Video Doorbell Dual
Daniel HesselDaniel HesselDaniel HesselDaniel HesselDaniel HesselDaniel HesselDaniel Hessel
Eufy's smart-looking device is an excellent option if you're looking for a subscription-free video doorbell on a budget. The Video Doorbell Dual records video at 2K, which is just fine for us, and is loaded with advanced features like package detection and the ability to play pre-recorded voice messages, all with no membership necessary.
It has an infrared sensor that detects visitors' body heat, while a radar motion detector scans for movement. Better yet, its software includes AI person-recognition, and during our tests, it was able to accurately identify and label visitors in our video clips. We didn't receive any false positives, and the detailed app notifications meant we could tell who was calling at a glance, without even picking up our phone.
All your footage is stored locally on the HomeBase 2 (bundled with the doorbell), which provides 16GB for your clips. You can buy cloud storage if you really want to, but there's no compelling reason to when you can keep control over your own videos and access them for free.
We didn't love having to take the doorbell down to charge it (there's no swappable power pack), but it can be connected to existing doorbell wiring if you'd rather not run it from its battery.
Chris PriceChris PriceChris PriceChris PriceChris PriceChris PriceChris Price
Swann makes some of the best video doorbells and best home security cameras we've tested here at TechRadar, and they all have one big selling point: there's no subscription plan necessary to save your videos or to use their most advanced features. Although you can pay for cloud storage if you really want to, it's not necessary at all.
The Swann Buddy4K is also a fully-fledged home security camera with features like motion detection and the ability to differentiate among subjects such as people, pets, cars, and packages. All of this is included with the initial cost of the doorbell (unlike devices from brands like Ring, which charge a regular fee to unlock such features).
"It’s possible to store videos by type – particularly handy if you want to find out when a parcel was left on the doorstep," said our reviewer Chris Price. "Alternatively, you can store videos in chronological order on the built-in MicroSD card."
The doorbell's AI assistant (which generates custom voice responses for visitors so you don't have to speak to them) was still in beta when we reviewed it, but even without it, it's an excellent device that comes highly recommended for helping secure your home.
James HollandJames HollandJames HollandJames HollandJames HollandJames Holland
The Philips 7000 Series boasts impressive video quality, great viewing angles, and a generous 8GB of onboard storage.
It boasts dual cameras to give a clear view of both visitors and any packages they may leave on your doorstep. Its 2K resolution will be ample for most homes (4K doorbells are now widely available, but usually burdened by subscription fees), and during our tests, we were thoroughly impressed by how sensitive it was to motion. In terms of responsiveness, it was up there with the best home security cameras. Night vision is crisp as well (the doorbell is equipped with infrared sensors).
We found installation refreshingly straightforward, with a choice of mounting plates so you can choose one to suit your home, and it can be used with existing doorbell wiring or wireless from a rechargeable battery.
The 7000 Series isn't the cheapest video doorbell around, but its price is competitive considering how much you're getting. It's around the same as the Ring Video Doorbell 2, which requires a membership to save and review video footage.
The only other drawback for us was a slight lag we noticed during two-way talk with visitors. Otherwise, the 7000 Series is hard to beat (though it's not currently available to buy in the UK).
Les WatsonChris PriceChris PriceChris PriceChris PriceChris Price
Aqara is well known for its excellent subscription-free video doorbells and home security cameras, and the Video Doorbell G4 ranks among the best. It works with all the main smart home platforms, which is quite rare, can run from a battery or be used wired, and is packed with extra features that you'd normally expect to come with a hefty subscription fee, such as subject-identification and customizable motion-detection zones.
You can store your videos on a microSD card installed in the doorbell chime supplied in the box, but Aqara also offers a free cloud storage plan that saves 7 days of recordings at no charge. You can pay for extra online storage if you really want, but there's no need.
Its field of view is narrower than you'd get with a Ring doorbell, and its picture isn't as sharp, but it's still a great budget option — and one that could get even cheaper on Amazon Prime Day.
The clever little EZVIZ EP4 is marketed as a security camera, and it does serve that purpose, but it does double-duty as a video doorbell, with a large push-button on top that triggers a notification on your phone when pressed, allowing you to see and speak to the person at your door via the EZVIZ app.
This is a great option for anyone who rents or lives in an apartment, because there's absolutely no drilling required, and when you want to move out, you can simply remove it and take it with you. Just unscrew the peephole from your front door, and you can install it in seconds. I used it at home and had it up and running within 10 minutes. Removing it is even quicker, and it did no damage to my door whatsoever.
The 4K picture is sharp and vivid, whether you're viewing it on the internal screen or within the EZVIZ app. The camera has AI person-detection, and can alert you when someone is at the door even if they've not pressed the bell. It can also use facial recognition to let you know when certain individuals have arrived.
There's no subscription required (videos can be stored on an internal MicroSD card), and for me, the only significant drawback is that the camera's field of view isn't wide enough to see packages on your doorstep. Note that the EZVIZ EP4 is currently only available in the UK.
Federal officials are urging the lone major tech company holdout to allow government safety evaluations, weeks after ordering Anthropic to pull its latest model.
A recent episode underscored the Trump administration’s increasing reliance on advanced A.I. systems for cybersecurity even as it battles a leading U.S. developer.
Tata Electronics has confirmed in a statement to BleepingComputer that it was the target of a cyberattack that impacted parts of its IT infrastructure. [...]
Login
