Technology Tales

Released on 12^th September 2026, Waterfox 6.7.3 adds an option to auto-hide vertical tabs and prevents tabs from changing width when audio plays. It restores compatibility with older extensions, improves tab highlighting and sidebar controls, brings back several appearance settings and fixes issues affecting bookmarks, private tabs, branding, backups and keyboard shortcuts. The release also improves JPEG XL support, restores the standard new tab layout without recommended or sponsored content and includes security updates covered by Mozilla Foundation Security Advisory 2026-93.

The Grav admin dashboard can flag when a harmless test file placed in a private storage directory can be reached directly over the web, which indicates that the web server is not applying Grav's access rules. A confirmed exposure should be treated seriously, since depending on which directories and file types are reachable, visitors could potentially download account files, configuration data, saved form submissions or complete site backups; the check itself only uses harmless sentinel files rather than real data. Newer versions of the check test .dat, .txt and .zip files across several private directories, while older versions only test a single .dat file, so passing that check does not guarantee other file types or folders are protected, and an absent warning is not a full security audit.

The problem typically arises because Grav depends on the web server to block direct requests to private folders, and this protection fails when Apache ignores .htaccess files, when a server such as Nginx or Caddy never reads .htaccess and lacks equivalent rules, when a front proxy serves static files before rules can apply, or when a custom server configuration has replaced Grav's default rules without preserving the blocks. Fixing this requires denying direct access to the backup, tmp, logs, and various user folders while still permitting legitimate public files such as avatar images and uploaded media, with exceptions configured to take precedence over the deny rules.

The specific method varies by server software, including Apache, Nginx, Caddy and LiteSpeed, and particular care is needed when a site sits behind a proxy, content delivery network or managed hosting platform, since rules must be applied at whichever layer actually serves the files. Some Grav versions allow backup and temporary directories to be relocated outside the web root using environment variables, though this does not protect account, configuration or form submission folders, which still require proper access rules.

Administrators can confirm a fix by reloading the dashboard or by manually placing harmless test files with random markers in the relevant directories and checking that unauthenticated requests are blocked, while being careful never to use real data for such tests. Finally, it is normal and intentional for common image, audio, video and PDF files under the user data folder to remain publicly accessible, since this supports media uploaded through form fields; the warning relates only to non-media files being exposed, and any private uploads should instead be served through an application-level proxy rather than direct folder access.

A new translation editor in Grav Admin 2.1 allows administrators to find and change every language string provided by Grav, plugins and themes, either by searching visible wording or browsing contributors and namespaces. Each entry shows whether it is unchanged, customised, missing or no longer recognised, while changes are stored in separate YAML files that survive updates and can be reviewed or reverted. The editor supports multiple languages, staged machine translation when the optional translation plugin is available, protected placeholders and bulk editing through YAML. It also provides a guided migration from the Translation Strings plugin, with previews and safeguards to prevent existing wording from being lost. Other changes include improved reporting of Twig security settings, more reliable collaborative editing and fixes to displayed messages, with the API plugin requiring an update alongside Admin 2.1.

Released recently, Grav 2.1 adds built in Markdown output for every page, available through a .md URL or an HTTP header, with front matter, navigation links and estimated token counts to support automated agents. It also introduces llms.txt and an optional combined file, theme controls and Twig functions for customising output, improved URL handling, configurable media types and ISO date presets. The release resolves problems affecting raw HTML processing, image cache clearing, debugging markers in feeds, compressed responses, command line cache clearing, Twig processing and long code heavy pages. It also corrects administrative user detection and updates Apache compatibility. Grav 2.1 upgrades in place from the 2.0 series, although backups and testing are advised, and Admin 2 should be updated alongside the core release.

Waterfox version 6.7.2 introduces several enhancements to its tree tabs and vertical sidebar features, aimed at improving reliability and user experience. Improvements include more consistent session restoration, better handling of tab dragging and sidebar interactions and refined visual alignment and controls for managing tab structures. The update also provides greater user control over tree tab settings, such as indentation, nesting limits and tab activation preferences. Fixes to the vertical sidebar address issues with pinned tab visibility, sidebar collapse during menu interactions and layout problems with full-screen video and tab icons. Changes to tab appearance ensure that unloaded tabs retain their default icon colours and that tab titles are no longer italicised by default. The release also includes security updates from the Mozilla Foundation Security Advisory 2026-85.

Incogni is a subscription-based service designed to help users remove their personal information from data brokers by automating opt-out and deletion requests. Initially developed by Surfshark and launched publicly in 2022, it operates by contacting over 420 brokers on behalf of users, with progress tracked through a dashboard and typical processing times ranging from thirty to forty-five days. The service expanded in 2025 to include custom removals for websites outside its automated list, supported by accreditation from the Better Business Bureau. Pricing varies across plans, with no free tier, and features differ primarily in user coverage and access to custom removals.

While the service uses AI and human assistance for scanning and matching data across brokers, it relies on legal frameworks like GDPR and CCPA to enforce compliance, though it does not confirm whether brokers fully adhere to requests. Privacy experts note that such tools are maintenance-focused rather than permanent solutions, as ongoing online activity can lead to data reappearing over time.

Established in 2019 under the Linux Foundation, the Confidential Computing Consortium focuses on advancing confidential computing, a technology that safeguards data not only when stored or transmitted but also during processing in memory by utilising hardware-protected environments. This approach mitigates risks associated with sensitive data exposure to operating systems, cloud administrators, or attackers with privileged access. The consortium promotes open standards and interoperability, develops open-source tools and fosters collaboration among hardware vendors, cloud providers and software developers to enhance security across cloud, edge and on-premises environments. It supports initiatives such as managing secrets, enabling secure application execution and verifying trusted software through remote attestation, while aligning with existing hardware technologies from major providers. Applications span healthcare, finance, multi-party analytics, AI training and compliance, with the consortium itself concentrating on software and standards rather than hardware development.

Microsoft has extended free security updates for Windows 10 until October 2027, providing additional time for organisations unable to transition to Windows 11 due to hardware limitations such as the absence of Trusted Platform Module 2.0 or Secure Boot capabilities. The extension allows existing Extended Security Updates (ESU) enrolments to continue automatically without further action, addressing the continued use of Windows 10 on hundreds of millions of devices globally. Enrolment options include using Microsoft Rewards points, a one-time fee, or account-based verification in Europe, though business-managed systems remain excluded from the consumer program. The decision follows rising hardware costs, particularly for memory components, which have increased due to shifts in manufacturing priorities, prompting some IT departments to delay upgrades. Alternative solutions, such as third-party micropatches and open-source operating systems, are also being explored by users who choose not to adopt Windows 11.

A security vulnerability in older Apple processors has been identified, affecting devices using A12, S4/S5 and A13 chips, including certain iPhones, iPads, Apple Watches and Apple TVs. The flaw resides in the BootROM, making it impossible to resolve through software updates, as the affected hardware cannot be modified in post-production. Researchers discovered that malformed USB packets can exploit a hardware-level bug in the USB controller, allowing unauthorised memory manipulation during the device’s startup process. While the exploit is easier to execute on A12 devices, newer A13 models include security measures like Pointer Authentication Codes that complicate the attack, though researchers successfully bypassed these protections. Once compromised, the exploit enables persistent control over the device, lowering security settings and allowing unsigned software to boot without verification. The vulnerability was reported to Apple before public disclosure and while it primarily impacts older hardware no longer in widespread use, affected users face no available mitigation.

The release of Grav 2.0 marks a significant evolution of the platform, introducing a modern single-page admin interface built on SvelteKit and Tailwind CSS, a stable first-party API for headless and decoupled workflows and support for AI agents through a dedicated MCP server. It leverages updated dependencies including PHP 8.4 and 8.5, enhanced security measures and performance improvements driven by modern libraries and streamlined core code. The new default theme, Quark 2, incorporates a refined design system with adaptive colour schemes and improved accessibility features. Migration to 2.0 requires a fresh installation followed by content import, with assisted or manual options available to ensure compatibility and minimise disruption, allowing users to test and transition at their own pace while maintaining support for existing 1.7 sites. This update establishes a foundation for future development, emphasising compatibility, extensibility and integration with emerging technologies.