The Download

Adobe Stock

TL;DR: What does it take to hack a Boeing 737? The answer might be a tiny $100 gadget that easily slots into a port accessible through an external hatch on the plane. Researchers say that this physical hacking method they created is a sign that aviation cybersecurity needs a 21st-century refresh.

What happened: The coin-sized device can take over the plane’s autopilot, modifying calculations that could impact takeoff and where the aircraft flies—all potentially without tipping off the pilot, according to researchers from the University of California at San Diego and Oberlin College.

The object can fit into a port accessible through a (typically unlocked) hatch on the outside of the aircraft—which Wired notes is “routinely within reach” of many airport personnel. And, despite its small form factor, the device also has wi-fi capabilities, which could potentially give the attacker remote control of it.

The good news is the gadget is just a prototype to show how easy-to-hide, wi-fi-enabled hardware could compromise a plane’s computer. And the researchers say there’s a simple, immediate fix (if messy)—fill this particular port with epoxy.

Why researchers did this: The team behind the device has been studying ways to hack planes for almost a decade and a half now. The hope is that this research will push the aviation industry to be more vigilant about cybersecurity threats—similar to what happened in the auto industry after researchers’ work on car hacking. (They’re also not publicly revealing every detail of how the plane hack works, or which exact port they targeted, for obvious reasons.)

Don’t freak out yet: This isn’t a five-alarm fire that should have people canceling their flights, researchers note. Boeing is also in the loop—the research team first reached out to the 737 manufacturer over six years ago.

Boeing told Wired that it conducted its own review of the 737’s current design, but believes that the “layers of protection in place” are enough to reduce the risk of such an attack actually happening. (How reassuring that is from Boeing is up to you.) And, to date, there’s been no publicly reported incident of a commercial flight’s computer system getting hacked.

Bottom line: There were over 6,700 Boeing 737s in service as of last June, per International Air Transport Association data—making it one of the most popular commercial aircraft models today. There’s no need to panic, but one lead researcher noted that if he were in the aviation industry’s shoes, he “would not sleep on this one.” —WK

Also in aviation…

• American Airlines’ AI has apparently been automatically rebooking passengers it predicts will miss their connections. Somehow, it didn’t predict the fallout.

      

Sponsored By Currex

Meet CURREX—the insole engineered by German sports scientists to change how you move. Long the top aftermarket insole in Europe, CURREX is now the #1 insole brand in US specialty running stores, trusted by elite and everyday athletes alike.

Built on advanced biomechanical engineering, CURREX insoles instantly upgrade the fit, feel, and performance of any shoe—no break-in required. With sport-specific designs for running, soccer, football, basketball, and more, there’s a CURREX built for exactly how you move.

Whether you’re chasing a new PR or just trying to make it through practice without your feet screaming, CURREX delivers measurable gains in comfort, efficiency, and injury prevention.

Step into performance, backed by science.

Robot, revisited

Disclosure: Companies may send us products to test, but they never pay for our opinions. Our recommendations are unbiased and unfiltered, and Tech Brew may earn a commission if you buy through our links.

I first raved about the Matic floor-cleaning robot in May, after over a month of testing. But who among us hasn’t been burned by a device a few months (and replacement parts) in? So I thought it was about time to re-review it after a longer period of use.

There was also good reason to revisit it now, as Matic launched a new feature, Matic Cues, today (and gave us early access for testing). The update means the bot will now respond to spoken commands and gestures. (Previously, it could only be set into motion via an app.) The feature is billed as a way to let anyone—a grandparent, child, or app-averse spouse—set Matic to task.

How we tested this: My husband and I spent two days running Berbie (what my son named our bot) through the wringer. We commanded that it follow us, asked it to meet us at the kitchen sink to refill the water tank, and pointed in a circle to vacuum a specific area or room.

At the moment, a spoken command “uses Gemini API to parse it anonymously,” says Mehul Nariyawala, Matic’s co-founder and president. This “enables 70+ languages and many commands.”

“Once we get an understanding of the top commands used, we will distill a smaller on-device model for those who do not want to use Gemini API,” he tells Tech Brew.

The Good: During testing, Matic Cues worked as advertised, responding to spoken commands and gestures. (As with the map of your floors, the gestures remain on-device.)

Cleaning and replacing parts is easy, with detailed videos within the app. (I’ve replaced the mop roll and side brush so far.) I’m generally not in favor of a bespoke bag, but Matic’s HEPA bags collect both wet and dry detritus, are easy to pop in and out, and cost as little as $2.50 a pop.

Berbie has cemented itself in my cleaning arsenal. I anticipate this bot will die someday, and if and when it does, I won’t hesitate to replace it.

The Bad: There were a few miscommunications, as much our fault as the bot’s. For example, initiating a command begins with, “Hey Matic,” not just “Matic,” and you have to speak clearly and succinctly. But after 24 hours, the bot and I had an understanding.

In five months of Matic maintaining clean floors in my home, it’s only lost the plot once. (It mistook a rug for hardwood and was mopping a carpet.) I deleted the map and had Matic remap the first floor and have had no issues ever since.

Verdict: ✅ Signal (still!) —AS

Sponsored By NiCE

AI that handles your biggest moments. When a record snowstorm grounded thousands of flights, travelers braced for hours on hold and missed connections. Not this time. NiCE AI agents rebooked over 410,000 passengers before the gate agent even clocked in. See what NiCE AI agents can do for your business.

The Zeitbyte

Still sweet on ‘Candy Crush’

Illustration: Morning Brew Inc., Photos: Adobe Stock, Candy Crush

For most people, FarmVille, Angry Birds, and Fruit Ninja are now a fond but distant memory of a time when we were still regularly posting on Facebook. But there’s one mobile game from that era that’s somehow stood the test of time: Candy Crush.

The cavity-inducing freemium game first launched on the web in 2011—and last year, it had around 81.5 million monthly active users and raked in $876.5 million in revenue, according to data from Business of Apps. Part of its enduring appeal is probably that it’s stupidly simple to grasp (and not so simple to master, with over 23,000 levels). Its dopamine loop also quickly lulls you into a “fugue state of swipes, explosions and victorious microvibrations,” as Bloomberg Businessweek put it. Online, dedicated players still share their achievements and swap tips—and there’s even an annual tournament that had a $1 million prize pot this year.

Our smartphones are a lot more capable than they were in 2011, but Candy Crush remains pretty much the same: It still looks like the chaotic inside of a piñata, and it’s still beloved by your mom, the person next to you on the train, and everyone who needs to procrastinate on important work. —WK

Chaos Brewing Meter: ☕/5

• The biggest IPO in history? (Again.) Anthropic investors reportedly expect the company to IPO at at least $2 trillion in October.
• Are your emoji choices giving away your age? A linguist told the New York Times there’s now a literal “boomer emoji.”
• President Donald Trump just signed a memo letting private companies launch cyberattacks on the government’s behalf (with oversight). The move has been likened to modern-day letters of marque.
• We’re getting a TV series about Sam Bankman-Fried’s “improbable rise and catastrophic fall” in November.
• Talk about reading the room…Twitch is training Amazon’s AI on users’ data by default, and its CPO says, “If it was opt-in, nobody would opt in.”
• Perhaps trying to distract from, well, *gestures at everything* Instagram just unveiled a new logo.
• Google’s AI safety team is telling job applicants not to trust the company’s AI hiring system in a memo marked “please do not share this.” Google, however, says the system works just fine.

^{*A message from our sponsor.}

This time last week...

Readers’ most-clicked story was about a woman’s snarky Bluesky posts about her neighbors, which turned her into public enemy No. 1 on her small town’s Nextdoor.