Standby on an LG smart TV is not off.

Top Story

Standby on an LG smart TV is not off. Packet captures and bench tests by Gamers Nexus, working with Level1Techs and independent security researchers, show retail webOS OLEDs — including the flagship G5 — continuously sweep the home network to map phones, smartwatches, and other devices, record clean microphone audio while the screen is dark, and hold onto voice samples locally when cut off from the internet, uploading them the moment a connection returns.

The detail that most undermines every privacy promise a TV maker makes is the offline behavior. During testing, the researchers disconnected the set from Ethernet and found it kept capturing voice input and storing the files, transmitting them only after network access was restored. That is not a misconfigured telemetry flag. It is deliberate design: the capture path survives a deliberate, user-initiated severing of connectivity, because the TV was built to assume reconnection eventually happens. A “powered down” television that continues to record is not in standby in any sense a buyer would understand — it is in its most alert state precisely when the owner believes nobody is watching.

The network mapping is broader than the microphone. Wireshark traces showed the sets scanning the local area network for unrelated hardware and, beyond internal IP addresses, harvesting the names and signal strengths of neighboring Wi-Fi networks along with location data. LG Ad Solutions, the company’s targeted-advertising arm, claims reach into 363 million secondary addressable devices in the US alone by tracking other hardware on the same network. That figure is worth sitting with: LG says it has sold roughly 216 million smart TVs globally, meaning the ad business monetizes a device graph roughly 68 percent (about two-thirds) larger than LG’s own installed base, assembled from neighbors’ routers and guests’ phones that never consented to appear in LG’s inventory.

The on-screen tracking is familiar by comparison. Automated Content Recognition samples audio and video into digital fingerprints to log what viewers watch across inputs, a practice well documented for years. What is new is that ACR is the least of it — the audio capture and LAN mapping run alongside it, and all of it funnels into the same advertising pipeline.

Two findings make this more than a privacy grievance. First, the researchers documented remote code execution vulnerabilities in webOS that are currently moving through responsible disclosure. A device that already performs broad network scans and outbound data sweeps by default, running code that can be remotely executed by an attacker, is a different threat model than a passive TV. LG has not commented as of writing.

Second, the researchers’ recommendation is blunt: disconnect LG sets from the internet and use an external streaming device instead. That is the practical counsel, and it points at the uncomfortable truth of the category — that the data-collection incentives are structural. The advertising arm’s business model depends on the television collecting ambient data about everyone in its physical and network vicinity, so no settings toggle or “do not sell” screen will resolve it. The fix is architectural: the TV should not be the thing on your network at all.

The concrete thing to watch is LG’s response to the disclosure process already underway. The company has to answer for the webOS RCEs, which are a security liability regardless of intent. But the harder question is whether LG will address the standby recording and offline queueing as bugs to be patched — or defend them as the necessary behavior of an ad-supported platform. How it characterizes its own design will tell you whether the company believes a TV in your home has an “off” state at all, and that is the answer everyone with a 216-million-device install base is waiting on. LG smart TVs caught logging audio with screen off and snooping on local devices

Also Today

Trusting-Trust Attack against an Entire Linux Distribution · Source Thompson’s trusting-trust attack was supposed to be a compiler’s curse; the paper behind arXiv 2607.24888 shows it isn’t. By manipulating only finished ELF files, the authors build a complete trusting-trust attack around GNU strip — a utility that never inspects or generates source — planting a payload in NixOS’s binary seed that propagates through every rebuild of strip and survives into the final standard environment once the seed leaves the dependency closure. On a real nixpkgs revision it produced a complete graphical installer and backdoored nearly every binary it touched. Reproducible builds were always the defense against hidden tampering; a subvertible build utility turns that same bootstrap into the channel for the compromise.

CERN Renounces RHEL in Favor of Debian for Its Accelerator Controls Infrastructure · Source CERN is abandoning the Red Hat ecosystem for its accelerator controls, a quiet but sharp rebuke of enterprise Linux roadmaps. The trigger was Red Hat’s compiler-baseline mandates — x86-64-v2 on RHEL 9, v3 on RHEL 10 — which would have obsoleted the 2,200 front-end computers and 17,000 embedded devices built on 10- to 15-year lifecycles. Debian’s continued x86-64 v1 support plus upstream PREEMPT_RT won out over CIP and Yocto. Scope matters: compute farms and Tier-0 stay on AlmaLinux and RHEL, so this is a niche migration, not an institutional exodus. Still, when the world’s best-known lab says a vendor’s march-flag rules its hardware estate, that is the failure mode of forcing compiler generations onto purpose-built machines.

The complex corporate web behind a $3.2 billion AI data center · Source Lake Mariner is the accountability story of the AI buildout boom. A fire in an unfinished building exposed firefighters going in blind — no alarm, no suppression, three dead hydrants, and safety sheets that reportedly burned in the blaze. TeraWulf leases from a company owned by its own CEO, Fluidstack will operate the center, Google guarantees the lease, and Anthropic’s compute demand justifies the $3.2 billion. New York found the promised 165 jobs shrank to 35–40, and “95 percent zero-carbon” quietly became “low-carbon” at 91 percent. Anthropic covers consumers’ electricity-price increases but has no apparent mechanism to verify the site’s clean-energy or safety claims. Whoever signs the lease, nobody is clearly the boss.

A Tesla ran a stop sign and killed a man, Full Self-Driving/Autopilot was on · Source A Tesla driver-assist system was verified engaged when a Model 3 ran a stop sign in Buena Vista Township and killed 82-year-old Stephen Field — information the public never got from the police reporting. Tesla filed the crash under NHTSA’s standing order, marked it “Verified Engaged,” then redacted the narrative, software version, and operating-area fields as confidential business information. The 4 mph pre-crash reading suggests a rolling stop, the behavior NHTSA recalled FSD over in 2022. Electrek can’t confirm FSD versus Autopilot, and neither can anyone else, because Tesla sealed the one paragraph that would say. Telling owners to trust its self-driving while classifying a fatal crash’s explanation as a trade secret is a contradiction regulators should find harder to swallow than they do.

WeatherNext 3 · Source WeatherNext 3 is less a new forecast model than a claim about how weather AI should be delivered: hourly global forecasts generated straight from raw satellite imagery rather than sampled from coarser runs. Google says it predicts station-targeted temperature and humidity at 5km resolution and wind at 10km, and it is feeding the results into Search, Maps, and Gemini. For wind and solar operators the appeal is obvious — hourly radiation and cloud-cover forecasts are real economic value. But the page’s own fine print says it best: this is an experimental research platform, and official warnings still belong to national weather services. Hourly forecasts in consumer surfaces are a trust play, not a safety certification, and the gap between helpful and authoritative is where the ambition meets its limit.

In Brief

• Switzerland’s federal government is piloting open-source replacements for Microsoft 365 across roughly 3,000 office computers. (Source)
• The vast majority of new smartphones on the market still flout the EU’s repairability rules, according to a fresh survey. (Source)
• Netflix is converging on the open-source Apache Flink Autoscaler to manage more than 30,000 streaming jobs across AWS regions. (Source)
• vlt 1.0 ships as a drop-in npm replacement, bringing phased installs, graph-based queries, and built-in malware blocking. (Source)
• Apple’s WebKit team is inviting developers to submit browser-interoperability proposals for the Interop 2027 effort. (Source)
• A developer squeezed a working Python interpreter into 1,024 bytes of golfed C code. (Source)
• Shenzhen Longsys Electronics begins trading in Hong Kong on Tuesday after raising $903 million in an upsized share sale. (Source)
• OpenAI, AIRPPU, and WAN-IFRA are launching an AI program to help Ukrainian newsrooms strengthen resilience and independent journalism. (Source)
• WhatsApp is working on a feature that would let users chat with up to five third-party AI agents at once. (Source)
• Kernel.org infrastructure maintainer Konstantin Ryabitsev warns that abusive crawlers have become a constant background radiation he can no longer ignore. (Source)
• An AI design tool called Adam generated a complete, tool-free-assembly flat-six engine from a written description as an editable parametric CAD file, reworking the bores and crank throws unprompted when the piston diameter changed. (Source)
• A leaked internal email captures Bill Gates wrestling with installing MovieMaker, in the latest installment of Internal Tech Emails. (Source)

One Line

And then after that it’s three guys and a bottle of Windex… unless there’s a commitment to train up people in the local communities to take on the operations and maintenance of these data centers, which I have yet to see a data center agree to do.

— Pilar Thomas, former deputy solicitor at the Department of the Interior, in Ars Technica’s Lake Mariner investigation