Founder
Sam Allcock is a founder of NerdBite.
He has spent more than two decades in UK digital marketing, working across digital PR, SEO and content, and advising on the sale of digital agencies and domain assets. He founded and sold two agencies - Custard, an SEO firm, in 2018, and the digital PR business PR Fire in 2024 - and wrote How to Sell Digital Assets (2025). He has contributed to HuffPost and HubSpot among others.
He writes here on technology and the business behind it: funding, acquisitions, the claims companies make about their products, and whether those claims survive contact with the record.
He oversees the site from Dubai and can be reached at sam@nerdbite.com.
A Python project claiming to run autonomous research has shot up GitHub's charts in under a fortnight, though there's little on offer beyond a README and thirteen commits.
A sandbox-escaping bug in every version of Chromium is under active attack, but the size of the bounty is raising more eyebrows than the bug itself.
A gorier, glow-up sequel to indie rail-shooter Railbreak has landed on Xbox, promoted by its own developer — here's what's confirmed and what's just marketing.
A newly logged bug scores a maximum-alarm 9.9 out of 10, but the fine print matters more than the number.
CISA says CVE-2026-85046 is being exploited right now, yet the public record barely tells us what the bug does or which Chrome version fixes it.
PRAXIST is billed as an 'autonomous research system', and developers are starring it in droves, but the claims on the project page are doing most of the heavy lifting.
OpenAI has shipped GPT-6 Astra with headline-grabbing benchmark scores, but a look at the small print - and a sceptical Hacker News crowd - suggests the comparisons doing the AGI talk aren't quite apples-to-apples.
Sucker Punch has confirmed the Ghost of Tsushima hero as a playable character in Most Wanted - just don't expect a full sequel starring him.
A newly listed flaw in Firefox Focus for Android carries a maximum-alarm score, yet Mozilla's own paperwork barely says what it actually does.
CISA says the flaw is being exploited right now — but its own listing is oddly light on what the bug actually does or who's behind the attacks.
An 'autonomous research system' has gone from nothing to 6,000-plus GitHub stars in under a fortnight, yet the documentation trails off mid-sentence and nobody's checked whether it actually works.
Claude Fable 5.1 is cheaper and generally available; its sibling Mythos 5.1, with fewer safety brakes, is locked behind vetting that most people will never see.
A new statistical tool from the Allen Institute for AI says popular LLM benchmarks quietly mix up different skills into one score — but the checking is being done by the people who built the method.
A flaw in a niche policy-checking package let attackers hide dangerous wildcard rules from GitHub's cloud login guardrails — but only a small slice of DevOps setups will ever encounter it.
CISA says CVE-2026-81578 is being actively exploited in the wild, yet the public record offers almost nothing on how the attack actually works.
A new open-source desktop app promises fast, lightweight Spotify playback with retro Winamp skins - but its entire foundation depends on a project whose future is being argued over on Hacker News.
KO_OP's cosy Jupiter life-sim is officially out of early access, though Xbox Wire's own write-up doesn't get around to saying what it costs or where else you can play it.
A new scheme promises to stop nursing and midwifery students fronting hundreds of pounds for clinical placements - provided they qualify for the right funding pot first.
A maximum-severity bug in the argocd-mcp server skipped login checks entirely - but only if you'd switched it on and pointed it at the open network in the first place.
CISA says CVE-2026-82078 is being exploited right now, yet the public record says almost nothing about how, by whom, or whether a fix even exists.
A research team has released the full design and simulator for a cable-driven robotic hand, claiming policies trained purely in software work on the real thing without adjustment - a bold claim that, for now, rests entirely on a preprint.
A Python repo promising an 'autonomous research system' has rocketed up GitHub's charts in under a fortnight, yet basic questions about who made it and whether it works remain unanswered.
A 1990s Super Metroid FAQ, written entirely in ASCII, has resurfaced as proof someone once justified 17,000 words without a single line of code - though a viral X-Files anecdote attached to it doesn't quite hold up.
No big reveal here, just Sony's regular community photo mode roundup - but it's a decent reminder of what's quietly good on PS5 right now.
A critical-rated flaw in the Kafka-alternative streaming platform boils down to an insecure default, not some exotic exploit - but that doesn't make it harmless.
CD Projekt Red let press watch Geralt and Roach wander a new region, but there's still no date, no price and no confirmed platform list.
Google says it's just following the official US government register, but the rebrand of a shared border lake shows how quickly a naming dispute becomes a Maps headache.
Downing Street says manslaughter and historic grooming cases are now excluded from sentencing changes, but there's no bill, no numbers and no date attached to the announcement.
A 9.8-rated bug can forge fingerprint checks in a niche identity tool called openssl_encrypt - which, despite the name, has nothing to do with the actual OpenSSL library.
CISA says CVE-2026-66384 is being exploited in the wild right now, yet the public record barely says what it actually does.
A new open-source tool lets Apple Silicon Macs run a virtualised iOS, but it demands disabled security protections and doesn't play nicely with the EU or Japan.
Xbox's own post says the new Fable footage runs both 4 minutes and 18 minutes, which tells you something about how carefully these previews get edited.
Amazon says a new compute instance type has landed in France; its own announcement page is oddly light on the numbers that actually matter.
A flaw in the little-used openssl_encrypt package could let an attacker fake a trusted contact's key - but the 'critical' label needs a reality check.
CISA says CVE-2026-53362 is being used in real attacks right now, yet the public record is almost entirely blank on what the bug actually does.
A tidy-sounding engineering win is real, but it doesn't mean your DNS lookups just got faster - and it took Cloudflare months to actually ship it.
Rebellion has shown off its new sci-fi shooter again, yet the headline promise of five concrete details doesn't survive contact with the actual post.
A new 'Approved Code' and milestone payments sound reassuring, but joining up is voluntary and the bailiff reforms are barely sketched out.
CVE-2026-16286 lets attackers upload dangerous files to TRtek's Software Repository Management tool, yet the advisory says nothing about a fix, active abuse, or how many people actually run it.
CISA has flagged CVE-2023-49105 as under real-world attack, but the small print matters: this is a federal-agency deadline, not a nationwide emergency.
dsh-routing-suite is racing up GitHub's trending charts, though its own README leaves more questions than answers about who built it and whether the numbers mean anything.
Headlines say Nvidia has snapped up the open-source AI hub for $13 billion, but the actual reporting says the deal isn't done yet.
Bit Reactor's Clone Wars tactics debut arrives 27 August, and Xbox's own advice piece is really a soft-sell dressed up as guidance.
A new opt-in service will text or email you when air quality turns bad in your area, though nothing changes unless you sign up yourself.
CVE-2021-23758 has just landed on America's most-watched vulnerability list, five years after it was first catalogued, and the public record explains almost nothing about how it's being abused.
The numbers on GitHub are real enough to check. Almost everything else about this project isn't.
CD Projekt Red has confirmed Geralt's latest comeback for Xbox, but not the price, other platforms, or what exactly 'Songs of the Past' is.
A fresh diplomatic appointment has landed on GOV.UK - here's what's actually confirmed, and why it's mostly irrelevant to your day-to-day tech life.
A Python HTML-sanitiser has patched several sanitisation bypasses - but the severity score depends entirely on who you ask, and mostly on how you've configured it.
America's cyber-security agency says a bug in the popular self-hosted Git platform Gitea is already being used in real attacks, yet the public record barely explains what it actually does.
A domain switch that sounded like it would break every masked email address you've ever handed out has, after grumbling from developers, been quietly scaled back.
Xbox has confirmed a new chapter in the Plague Tale series is coming to Game Pass, but a mythological monster and a vague podcast are about all we've actually got to go on.
A ministerial trip to Cambodia is really a diplomatic photo-op - but the demining operation behind it is a genuine, measurable piece of humanitarian engineering worth separating from the rhetoric.
A stack overflow in a niche WiFi access point has been rated maximum severity, though the number attached to it deserves more scrutiny than the bug itself.
CVE-2026-21962 scores a perfect 10 out of 10 and is already being exploited in the wild - but this is squarely an enterprise problem, not one for home users.
Valve's storefront now shows a product called Steam Machine with a firm price tag, yet the actual page tells us almost nothing else - so here's what's confirmed and what isn't.
A TypeScript project from the DeepSeek stable has rocketed up GitHub's charts in under a fortnight, though the details of what it does, and whether the numbers mean what they seem to, remain thin on the ground.
One person's viral blog post shows how far AI-assisted reverse engineering has come, but this is a personal experiment, not a security alert for the rest of us.
A newly published CVE rates 9.8 out of 10, but before anyone panics it's worth asking who actually runs this plugin, and whether it's even fixed yet.
A critical bug in vCenter's Syslog server has earned a place on America's most-wanted vulnerability list, but the scarier detail — Chinese hackers, hundreds of victims — comes from a blog post, not CISA.
A TypeScript project from DeepSeek's GitHub org has racked up six-figure stars in under a fortnight, yet the page itself offers almost nothing to say what it does or why it's exploding.
A 2006 journal entry about cast-iron bathtubs vanishing overnight has racked up hundreds of upvotes on Hacker News, but there's no way to check any of it - and that's rather the point.
A joint statement condemns new construction tenders in the West Bank's E1 zone and warns businesses of 'legal and reputational consequences' - but there's no sanction, ban or enforcement mechanism attached.
A 9.1-rated bug sounds terrifying, but check who's actually running this before you panic - it's not your laptop.
A critical flaw in a Russian videoconferencing platform is being actively abused, but unless you're running TrueConf's server software yourself, this one passes you by.
A TypeScript project from DeepSeek's GitHub org has rocketed to six-figure star counts in under a fortnight, yet the actual pitch amounts to a tagline and a folder full of AI agent scaffolding.
A developer's essay argues performance optimisation has gone from rare craft to commodity thanks to AI coding tools - but the comments underneath poke a fair few holes in that theory.
Infinity Ward is talking up clearer sightlines and slicker movement for its Korea-set shooter, but the actual detail hasn't materialised yet - here's what's confirmed and what's still just promise.
CVE-2026-70496 hands a helper component cluster-admin-level powers on paper, but Red Hat's own rating and the fine print tell a calmer story.
A serious, unauthenticated bug in Zimbra Collaboration Suite is already being exploited — but only a specific, non-default setup is actually exposed.
A wheeled bathtub, a steep hill and a coffee-break joke have become a real Xbox release - though the official post is oddly thin on the basics.
AWS says it's opened a Local Zone in Las Vegas, Nevada - here's what that actually means, and what its own announcement conveniently doesn't spell out.
The security regulator has issued a solidarity statement, not a policy change — here's what's actually new and what isn't.
A newly disclosed WebAssembly flaw in Firefox scores near the top of the danger scale, though Mozilla's own rating and the lack of any known attacks tell a calmer story.
A critical bug in the self-hosted video conferencing platform is now on the US government's confirmed-exploited list, but this is an enterprise problem, not a household one.
A TypeScript project from DeepSeek's GitHub org has rocketed up the charts, but the numbers tell you more about hype than about whether the thing actually works.
The company that lets developers shop between hundreds of AI models says nothing will change for users – but the reported price tag and the motive behind the deal are worth a second look.
Jagex's survival-crafting spin on Gielinor gets a Game Pass date, though the announcement itself is little more than a title card and a countdown.
A stack overflow in a bundled nginx binary has earned the maximum CVSS score, but the affected device is a niche, ageing wireless controller rather than anything on your desk.
A validation gap in MLflow's webhook testing feature can be abused to sneak past security checks and reach internal systems — and someone is already doing it.
A new DeepSeek repo has rocketed up GitHub's charts in under a fortnight, yet the project page offers little more than a slogan and a commit log.
PlayStation has confirmed pricing and a November release for its first desktop speakers, but this particular announcement only applies to a handful of Southeast Asian markets.
A £442 million package and a promise sound big, but the smallprint shows a familiar gap between ambition and delivery.
A 9.1-rated bug sounds terrifying, but check the small print: you need admin-level access to abuse it in the first place.
A 9.8-rated bug in Microsoft's IKE service lets attackers run code with no clicks and no credentials — and it's already being used in the wild, not just theorised.
A developer went digging into why Bluesky's logo appears on screenshots but not on screen - and found the app is quietly abusing a privacy API meant for something else entirely.
Sony's monthly download chart is real, but 'top' doesn't mean what you might think — there are no numbers attached, just an order.
The regulator's own risk assessment shows a real rise in cases, but that's likely as much about better detection as it is about scarier criminals.
A critical authentication bypass has been logged against a single Tenda AC10 firmware build - here's what's actually confirmed and what's still guesswork.
A browser trick and some old-fashioned DNS trickery can apparently hijack machines running Ray in dev mode – but only if you're the kind of person running Ray in dev mode.
Alibaba's latest small local model produces some of the best output yet seen from a laptop-sized LLM, but only after it's finished agonising over the question.
GD Studio's tiny team is offering 20% off a game launching in under two weeks, though the number that discount actually applies to hasn't been published.
The government says thousands of homes will get fast-tracked next to well-connected stations - just don't ask how close, how many, or when.
A scoring of 9.8 sounds terrifying, but the flaw only bites sites running Grav's API plugin with super-user API keys already in play - here's what actually happened and who needs to patch.
A critical bug lets attackers run commands on LoadMaster boxes with no login required, but this is an enterprise networking story, not one for home routers.
A new analysis of the SELECT trial reports a lower predicted dementia risk on semaglutide. But it measured a blood-protein signature, not actual dementia — and the drug's dedicated Alzheimer's trials found no clinical benefit last November.
Google shipped a new "workhorse" model three weeks after the last one. The coding numbers are all first-party, the launch price is introductory, and UK users cannot reach it in the Gemini app at all yet.
CVE-2026-68820, a use-after-free bug in the WinSock driver, lets someone already on your PC escalate to SYSTEM. CISA has told federal agencies to patch by 25 August. Here is who is actually at risk, and who is not.
The second weekend was open to everyone on Xbox and PC with no pre-order. A free multiplayer weekend seven weeks before launch is a server stress test and a marketing push dressed as a demo — which is worth saying plainly.
Both of those things are true at once, and the gap between them is the whole story of how mobile coverage gets measured.
CVE-2026-68820 is a privilege escalation in a Windows networking driver. It cannot get an attacker in, which is the point: it is what they use once they are already there.
CVE-2026-20349 lets an unauthenticated attacker reboot a Cisco firewall from the internet. It does not steal anything, which is exactly why it is easy to underrate.
Our weekly read of Netflix’s own Top 10 data for the UK, US and UAE. This week it exposes how the chart is actually built — and how differently the three countries watch.
CISA publishes a free list of every vulnerability it has confirmed is being exploited in the wild. It is a far better patching queue than severity scores, and you do not need a security budget to use it.
Hello Games marked a decade of free updates this week. The redemption story gets told often; the part about what it cost the people who built it does not.
The CMA closed its Phase 1 inquiry on 6 August without referring the acquisition, and the Secretary of State declined to intervene on public interest grounds.
AMIE reads visual and audio cues and guides a virtual physical examination. Clinicians rated it well — against simulated patients, in a research setting Google says is not ready for real use.
Cloudflare mitigated 935 attacks above 1 Tbps in six months, up 519 per cent quarter on quarter. Media, production and publishing took more of it than any other sector.
The FDA has cleared a hearing aid feature for Galaxy Buds 3 Pro and Buds 4 Pro. It ships in the US and “select markets” in the fourth quarter, and Samsung has not said whether the UK is one of them.
Sponsored results reached British users on 11 August. They appear on the Free and Go tiers, they are chosen from what you type, and paying more is the only way to switch them off.
Two Cisco Secure Firewall products were added to the US catalogue of actively exploited vulnerabilities on 11 August, with a deadline of 14 August. The short clock is the tell.
Kassper puts a person on every plan. Two years ago the AI SDR category sold itself on removing exactly that, and the retreat says more about the market than the launch does.
The identity firm has passed a Kantara audit covering Right to Work, Right to Rent and DBS checks. Its announcement also claims the government has ended its digital ID scheme, which is not what happened.
Inevitable AI Group has raised a $6m pre-seed to mass-produce software companies. The plan is striking, the budget per venture is thin, and one figure in the announcement does not match the record.
Netflix publishes its own Top 10 for every market. Read side by side, the UK, US and UAE charts show how differently the same week lands in three countries.
