Jump to content
View in the app

A better way to browse. Learn more.
Dynexplorer Community

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Ates

Members

  • Joined

  • Last visited

View Profile Find content

Blog Entries posted by Ates

  1. Not every conversion job is the same. A single invoice processed once a week is a different situation from fifty scanned reports processed every morning. The tool that works fine for one will frustrate you with the other.
    Most people start with a free tool. That is the right call. But free tools have real limits. Hitting those limits mid-deadline or mid-batch wastes more time than a paid plan would have cost. Knowing where the line sits before you reach it matters.
    What Can You Actually Do With a Free JPG to Excel Tool? 
    Free tools handle single-file conversions of clean images well. They are limited on batch processing, file size, complex layouts, and language support.
    Free browser-based converters handle the core task well. You upload a JPG, the tool runs OCR, and you download an XLSX file. For clean images with simple table structures, the output is usable with minimal cleanup.
    Where free tools typically draw the line:
    Batch processing—Most free tiers process one file at a time. Some cap-free users have three to five conversions per day. If you are working through a stack of documents, those limits slow you down fast.
    File size — Free plans often cap uploads at 5MB to 10MB. Multi-page document scans at high resolution go over that limit quickly.
    Complex layouts — Basic OCR handles standard bordered tables well. Multi-level headers, merged cells, and irregular column spacing push past what entry-level engines handle cleanly.
    Language support — Free tiers sometimes limit OCR to a small set of languages. Non-English documents or files with special characters may produce errors that paid tiers handle correctly.
    Where Do Paid JPG to Excel Tools Outperform Free Ones? 
    Paid tools improve batch processing, accuracy on difficult documents, and priority processing speed. The core conversion on clean images is similar to free tools.
    Batch processing is the most significant practical difference. Paid plans allow you to upload and process multiple files at once. For teams processing invoices or reports daily, this difference alone justifies the cost. Batch upload beats one at a time every time. 
    Accuracy on difficult documents is the second real difference. Paid tiers use more advanced OCR engines or AI-driven structure detection. This handles low-quality scans, borderless tables, and irregular layouts more reliably. The gap is not visible on clean images. There, Both free and paid tools perform similarly. It shows up on compressed photos, faded documents, and complex multi-column layouts.
    Priority processing matters for time-sensitive work. Free tier conversions on busy platforms can queue behind paid users. A file that processes in ten seconds on a paid plan may take several minutes during peak hours on a free tier.
    How Do You Choose Between a Free and Paid JPG to Excel Tool? 
    It depends on how often you convert, how complex your documents are, and how sensitive the data is.
    How often do you convert files? Once or twice a week sits comfortably within free tier limits for most tools. Daily conversion of multiple files does not.
    How complex are your documents? Standard invoices, clean screenshots, and simple printed tables convert well on free tools. Documents with merged cells, multi-level headers, colored backgrounds, or degraded print quality benefits from paid-tier OCR engines.
    How sensitive is the data? Most reputable free tools delete files after processing. Some organizations need more than basic file deletion. GDPR compliance, industry regulations, and audit trails all require documented security practices. A paid plan covers this. A free tool’s privacy page does not. 
    Is there a middle ground between free and paid conversion tools?
    Yes. Credit-based pricing lets you pay per conversion with no monthly subscription and no expiry on credits.
    Several tools offer this model. You buy a pack of conversion credits and use them as needed. This works well for irregular workloads — months where you convert ten files, followed by a busy period where you convert fifty. It avoids paying a monthly subscription during quiet periods. It keeps access to paid-tier features at the same time when volume increases.
    This model suits freelancers, small teams, and anyone whose conversion volume spikes unpredictably.
    Which Tool Gives the Best Free Results?
    Not all free tools are equal. Some impose daily caps. Others delete your file before you finish reviewing it. A few require account creation just to download the output.
    WPS’s online tool lets you convert JPG to Excel in the browser with no account and no conversion cap. You upload, convert, and download. No timer, no signup, no daily limit. For standard documents, it handles bordered and borderless tables without any preprocessing.
    That combination — no limits, no login, browser-based — makes it a reliable starting point before deciding whether a paid tool is necessary for your workload.
    What Should You Look for in Any Tool, Free or Paid?
    Regardless of pricing tier, some things should not be negotiable.
    Table structure preservation matters more than raw text accuracy. A tool that extracts all the text but loses the row and column relationships produces output that is harder to fix than manual entry. Test any new tool on a sample of your actual documents before building a workflow around it.
    Clear privacy terms are non-negotiable for business documents. The tool should state explicitly that files are deleted after processing. It should also confirm that uploaded content is not used for training or shared with third parties. Vague privacy policies are a reason to look elsewhere for anything sensitive.
    No arbitrary conversion limits matter for reliability. A tool that cuts you off midday because you hit a daily cap is a problem when you are working to a deadline. For regular use, prioritize tools that do not restrict standard conversions without warning.
    How Do You Test a Tool Before Committing to It?
    Do not test with your easiest file. Test with the hardest one you regularly work with.
    Run a borderless table through it. Upload a compressed phone photo. Try a document with merged header cells. These are the cases where tools diverge. If the output on your most difficult file is clean enough to use with light editing, the tool works for your needs. If it requires significant correction, look for something with stronger table detection.
    Most tools offer a free trial or a limited number of free conversions. Use that allowance on representative samples, not on the cleanest invoice you have.
    When Does It Make Sense to Pay for a JPG to Excel Tool? 
    Paying makes sense when you convert files daily, work with low-quality or complex documents, or handle data with regulatory requirements.
    Volume is the clearest signal. If you convert files daily or in batches, a free tier will slow your workflow with caps and one-at-a-time processing. For standard everyday files, a browser-based JPG to Excel tool with no caps, handles the job without any cost.
    Document quality is the second signal. Regularly working with low-quality scans, phone photos, or non-standard layouts means free-tier OCR will produce inconsistent results. Paid engines handle these cases more reliably.
    Data requirements are the third. If your documents contain financial records, client data, or anything covered by regulatory requirements, a paid plan with formal compliance documentation gives you a defensible paper trail. A free tool’s privacy page does not.
    Conclusion
    Free tools work. Paid tools work better in specific situations.
    If you convert files occasionally and the images are clean, there is no reason to pay. If you are processing batches daily, working with difficult documents, or handling sensitive data, a paid tier is worth it.
    Know your workload before you pick a tool.
    FAQs
    Can I convert JPG to Excel online for free without any daily limits?
    Some tools cap free users daily; others do not. WPS’s online converter processes files without conversion limits or account requirements, making it practical for regular use.
    What is the main difference between free and paid JPG to Excel converter online tools?
    The core conversion is similar in clean images. The real differences are batch processing, file size limits, accuracy on difficult documents, and data security documentation. Paid tiers deliver more on all four.
    Does image to excel conversion quality improve on paid plans?
    On clean standard documents, the difference is minimal. On low-quality scans, borderless tables, and complex layouts, paid-tier engines produce noticeably better output with less cleanup required.
    Are free jpg to excel tools safe for business documents?
    Reputable free tools use encrypted uploads and delete files after processing. Check that these are stated clearly in the privacy policy. For documents under regulatory requirements, a paid plan with formal compliance documentation is the safer choice.
    When does it make sense to pay for a JPG to Excel conversion tool?
    When you process multiple files daily, work with complex or low-quality documents, or handle sensitive data requiring documented security practices. For occasional single-file conversions of clean images, free tools are sufficient.
  2. The agency tasked with defending America’s civilian government networks nearly handed attackers a way inside. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, had working credentials sitting in plain text on the open web, where anyone could grab them.



    Key Takeaways:
    A GitGuardian researcher found CISA and Homeland Security credentials, including access tokens and cloud keys, exposed in plaintext spreadsheets inside a public GitHub repository.
    The repository was maintained by an employee of a CISA contractor, and the researcher confirmed some of the keys actually worked.
    CISA, which advises others to store passwords in secure managers rather than spreadsheets, says it found no sign that sensitive data was compromised.
    A researcher acting in good faith spotted the problem first, which is likely the only reason this became a near-miss instead of a full breach.
    The discovery came from Guillaume Valadon, a security researcher at GitGuardian, and was first reported by independent journalist Brian Krebs. Valadon found stacks of plaintext credentials sitting in spreadsheets that an employee at a CISA contractor had left publicly readable in a GitHub repository.
    Those credentials weren’t trivial. Valadon told Krebs they opened the door to systems run by CISA and its parent, the Department of Homeland Security. The haul included access tokens, cloud keys, and other sensitive files. To be sure he wasn’t crying wolf, Valadon tested some of the keys himself and confirmed they were live.
    He didn’t go straight to Krebs out of preference. Valadon first tried to alert the contractor responsible for the GitHub environment, but nobody answered. Only after those warnings went nowhere did he take the issue to a reporter.
    The episode stings for an agency in CISA’s position. Its entire job is securing the civilian federal network and telling everyone else how to handle their own security. Part of that advice, repeated often, is to keep passwords inside protected password managers and far away from loose spreadsheets, which is precisely the practice that tripped up its own contractor.
    Whether anyone besides Valadon ever stumbled on the credentials remains unknown. When TechCrunch asked, CISA spokesperson Marco DiSandro said the agency is “aware of the reported exposure and is continuing to investigate the situation,” and that there is “no indication that any sensitive data was compromised as a result of this incident.”
    The agency stayed quiet on the follow-up questions. It would not say whether it had spotted any breach tied to the exposure, and it didn’t respond when TechCrunch asked whether the leaked credentials had been revoked and swapped out.
    The fault traces back to a contractor’s employee, but the responsibility doesn’t stop there. CISA owns the security of its own network and systems, and that ownership extends to the contractors working on its behalf.
    The timing lands awkwardly. CISA has had no permanent director since January 20, 2025, the day Jen Easterly stepped down ahead of the incoming Trump administration. The agency has also shed roughly a third of its staff through cuts, furloughs, and layoffs since Trump returned to office, leaving a thinner team to guard a network that just had its own keys left on the doorstep.
    Written by Vytautas Valinskas
  3. Google spent its annual developer conference doing two things at once: wooing the coders who build on its tools and the everyday users who type into its search bar. The pitch on Tuesday in Mountain View centered on a faster, cheaper Gemini model and a fresh batch of AI agents, all aimed at slowing down enterprise wins by rivals Anthropic and OpenAI.



    Key Takeaways:
    Google launched Gemini 3.5 Flash for coding and automation, with Gemini 3.5 Pro arriving next month, and cut its top AI Ultra plan to $200 a month while adding a $100 developer tier.
    New agents will autonomously buy products, watch for ticket availability, and build schedules, while Gemini Spark drafts reports by pulling data from Chrome, Gmail, and YouTube.
    Gemini now counts 900 million monthly users, AI Overviews reaches 2.5 billion, and Alphabet expects to spend $180–190 billion on AI infrastructure this year.
    Alphabet recently edged close to Nvidia as the most valuable company on the planet, and the company leaned into that momentum. Beyond the new model, it doubled down on Search and YouTube by announcing agents that handle tasks on their own—making purchases, tracking when tickets free up, and arranging plans as conditions change.
    The logic, according to Pichai, is simple. “When people use our AI-powered features in Search, they use Search more,” the Alphabet CEO said.
    This was Google’s first big stage moment since last winter’s Gemini update clawed back ground in the AI race. The tone had shifted, too. At earlier conferences, executives looked rattled by the threat that chatbots and AI-native search startups posed to Google’s business. This time they spoke like a company writing the script rather than reacting to one.
    Demis Hassabis, who runs Google’s DeepMind lab, reached for the grand framing. “When we look back at this time, I think we will realize that we were standing in the foothills of the singularity,” he said. “It will be a profound moment for humanity.”
    Cheaper AI for the corporate crowd
    The new Gemini 3.5 family anchored the announcements. Gemini 3.5 Flash, tuned for coding and automated work, went live Tuesday. Pichai said the more powerful 3.5 Pro lands next month.
    On price, Google moved aggressively. It dropped the top-tier AI Ultra plan—which unlocks higher usage limits and the most capable models—to $200 a month, down from $250. A new $100 tier arrived alongside it, built for developers and other professional users.
    The competition has tilted toward business customers who spend heavily, and Google wants to win on cost. “We’ve heard that many companies are already blowing through their annual token budgets, and it’s only May,” Pichai said, using the term for the chunks of data AI models churn through.
    He put a number on the savings: heavy users like large companies could trim more than $1 billion a year by switching to Google’s models. In a press briefing beforehand, he said those models match the performance of other frontier systems at up to a third of the price.
    OpenAI and Anthropic, both preparing for public offerings, have been chasing the same lucrative enterprise accounts. Google answered with a refreshed version of its coding assistant Antigravity, a direct rival to Anthropic’s Claude Code. The company had laid groundwork last year by hiring key people from Windsurf, a well-known startup in AI code generation.
    Consumer reach as the engine
    The announcements showed a company that has shaken off its earlier worries. For a while, the fear was that ChatGPT or search upstarts like Perplexity might erode Google’s dominance. Instead, Google turned its enormous user base into leverage, wiring Gemini into the personal data flowing through Chrome, Gmail, and YouTube.
    Gemini Spark, introduced Tuesday, taps those apps to draft reports and juggle schedules. The numbers behind Gemini back up the confidence: 900 million monthly users now, up from roughly 400 million last May. AI Overviews in Search has reached 2.5 billion monthly users, and AI Mode sits near 1 billion.
    Search itself is changing shape. It will now answer some questions with AI-generated visuals and code—explaining scientific ideas or whipping up small tools like a fitness tracker. Liz Reid, the vice president who heads the search team, framed it bluntly. “We’re entering the next chapter of Google Search, where incredible AI features aren’t just in search, Google Search is AI search, through and through,” she said.
    Nick Fox, the senior vice president running Search and Ads, went further in an interview before the event, calling the overhaul the “biggest reinvention of the search box in 25 years.”
    That box still pays the bills. Search drove most of Alphabet’s revenue in 2025, when the company posted $402.8 billion in total revenue. The infrastructure bill keeps climbing too, with capital spending projected at $180 billion to $190 billion this year.
    Video, world models, and glasses
    Google also showed Gemini Omni, a video model executives positioned as the heir to the Nano Banana image generator. Nano Banana had one of Google’s rare viral hits, drawing 13 million first-time users in four days last September.
    Hassabis described Omni as a step toward a “world model” that can simulate how the physical world behaves. “Starting with video, but over time, Omni will be able to generate any output from any input,” he said.
    Hardware made the list as well. Google set this autumn as the window for a revived smart glasses project, built with Samsung and eyewear makers Warby Parker and Gentle Monster.
    Written by Vytautas Valinskas
  4. Instagram switched on a worldwide feature yesterday called Instants, pitched as a way to share fleeting, candid photos that vanish after viewing. The Meta-owned platform framed it as a fresh format for capturing real-life moments, but plenty of users opening the app for the first time discovered something less charming: their photo had already been beamed out to hundreds of contacts before they understood what tapping the shutter even did.


    Key Takeaways:
    Tapping the Instants shutter button immediately sends the photo to everyone on your Friends list by default, with no preview or confirmation step.
    You can disable the feature entirely through Settings → Content Preferences → Hide Instants in Inbox.
    An Undo option appears after sending, and the archive (four-box icon at the top of the camera) lets you delete photos before recipients open them.
    The setup looks innocent enough. Tap the little stack of photos in the bottom-right corner of your Instagram inbox, and a short tutorial appears. It tells you that Instants disappear, there’s no viewers list, and any reactions or replies stay private. The walkthrough then shows you how to view and react to images others have sent.
    Then comes the camera. A shutter button sits at the center. Beneath it, a toggle switches between two audiences: “Friends” and “Close Friends.” Friends is the default.
    What the tutorial skips over is the part most people would actually want flagged: the second you press the shutter, the photo flies out to everyone on your Friends list automatically. No review screen. No confirmation tap. Unless you’ve manually switched the toggle to Close Friends beforehand, your entire Friends list gets it.
    An undo button does appear after the photo sends, but it sits where most people aren’t looking, especially during the small flash of panic that follows realizing you’ve just shared something you didn’t mean to. Some users haven’t even noticed a photo went out at all.
    For an app where people are used to picking the right filter, cropping, second-guessing the caption, and then maybe still not posting, the instant-send mechanic has rubbed plenty of users the wrong way. Privacy is the obvious concern, and the design doesn’t make much room for hesitation.
    So, how do you switch it off?
    How to turn off Instants
    Open your profile, tap the three-line menu at the top right to reach settings, then scroll to Content Preferences. There, toggle “Hide Instants in Inbox.”
    With that flipped on, the Instants section disappears from your inbox entirely. You won’t see Instants sent by anyone else either.
    If a full shutdown feels like too much, there’s a middle option: press and hold the Instants pile in your inbox, then swipe right. That temporarily pauses Instants from people without removing the feature outright.
    How to undo an Instant
    The moment a photo sends, an Undo option appears just below the shutter button. Tap it quickly and the image pulls back before recipients open it.
    There’s also a longer-window option. Tap the four-box icon at the top right of the camera to open your archive. From there, deleting an Instant unsends it to anyone who hasn’t yet viewed it.
    The fix is straightforward once you know where to look — the trouble is that most people don’t find out until after the photo has already gone.
    Written by Vytautas Valinskas
  5. Anthropic has been sitting on an AI tool called Claude Mythos that is apparently so adept at sniffing out software security holes that the company refused to ship it to the general public. Instead, a handpicked group of security researchers and enterprise partners got the keys. We now have a live demonstration of what it can do — and the target is Apple’s freshly fortified M5 silicon.



    Key Takeaways:
    Researchers at Palo Alto-based Calif used Claude Mythos Preview to build the first publicly disclosed macOS kernel memory corruption exploit on Apple’s M5 chip, surviving the company’s new Memory Integrity Enforcement protection.
    The full exploit chain — from unprivileged local user to root shell — came together in roughly five days of work, after Apple had spent five years and an estimated multi-billion-dollar budget engineering the defense it bypassed.
    Calif disclosed the bug to Apple in person at Cupertino and will publish a 55-page technical writeup only after a patch ships; macOS Tahoe 26.5 already credits Calif and Anthropic Research for related fixes.
    The Wall Street Journal first reported the work, which comes from a Palo Alto outfit called Calif. In a blog post published Thursday, the team described what they pulled off as the “first public macOS kernel memory corruption exploit on Apple M5.” Strip away the jargon and the takeaway is uncomfortable: an unprivileged local user can ride this chain all the way up to full device control.
    Their write-up describes a chain involving “two vulnerabilities and several techniques.” The headline detail, though, is the assistant. Anthropic’s Claude Mythos Preview helped surface the bugs and walked alongside the humans through exploit development.
    “Mythos Preview is powerful: once it has learned how to attack a class of problems, it generalizes to nearly any problem in that class. Mythos discovered the bugs quickly because they belong to known bug classes,” the post said.
    Whether the specific flaws Calif found have already been patched is muddy. MacRumors noted that Apple’s release notes for macOS Tahoe 26.5, which shipped Monday, mention a fix for a bug submitted by Calif together with Claude and Anthropic Research, and Calif is credited in two other vulnerability advisories. But Calif’s own post says the team met with Apple “early this week,” which suggests the fix for this particular chain may still be inbound. “Full technical details will be shared after Apple fixes the vulnerabilities and attack path,” the researchers wrote.
    An Apple spokesperson sent the WSJ a familiar line: “Security is our top priority, and we take reports of potential vulnerabilities very seriously.”
    Why this particular crack matters
    Apple did not stumble into this. The company has been hardening its silicon against exactly this category of attack for half a decade. The marquee result is MIE, or Memory Integrity Enforcement — a hardware-assisted memory safety system built on ARM’s Memory Tagging Extension (MTE). MIE was introduced as the flagship defense on the M5 and A19, aimed squarely at memory corruption, the bug class behind some of the nastiest iOS and macOS compromises ever pulled off.
    By Apple’s own research, MIE breaks every publicly known exploit chain against modern iOS, including the leaked Coruna and Darksword toolkits. Many in the security community consider Apple devices the most locked-down consumer hardware money can buy. The investment, by Apple’s accounting, has run into the billions.
    Calif’s chain pokes a hole in that picture — not because MIE is broken in some catastrophic way, but because the right pair of bugs plus the right helper still gets you in.
    How the chain came together
    The discovery itself was, by Calif’s own admission, partly accidental. Bruce Dang found the bugs on April 25. Dion Blazakis joined the company two days later. Josh Maine built the tooling. By May 1, the team had a working exploit.
    The result is a data-only kernel local privilege escalation chain aimed at macOS 26.4.1 (25E253). It begins as an unprivileged local user, uses only ordinary system calls, and ends with a root shell. The target is bare-metal M5 hardware with kernel MIE switched on. Two vulnerabilities, several techniques, one path to the top.
    Mythos Preview did not act alone. The Calif researchers were careful to credit human expertise: the model is fluent at recognizing known bug classes and racing through them, but a brand-new mitigation like MIE still benefits from a person who knows where to push.
    “Part of our motivation was to test what’s possible when the best models are paired with experts. Landing a kernel memory corruption exploit against the best protections in a week is noteworthy, and says something strong about this pairing,” the team wrote.
    An in-person disclosure, laser printed
    Rather than dumping the report into Apple’s submission queue, Calif drove to Apple Park and handed it over in person — laser printed, as a nod to hacker tradition. The team wanted to avoid the fate of recent Pwn2Own participants whose reports got swamped in volume, and also, by their telling, wanted a small edge in the race for Twitter glory.
    “Most respected hackers avoid human interaction whenever possible, so this physical strategy may give us a slight edge in the eternal race for five minutes of fame and glory on Twitter,” they wrote.
    The 55-page technical breakdown is being held back until Apple ships a fix.
    The bigger picture
    MIE was never sold as unbreakable. Mitigations exist to make attacks more expensive, not impossible — and Apple controls enough of the stack to make that price tag punishing. But Calif’s point is that the cost calculus is being rewritten while we watch. AI-assisted bug discovery is here, it generalizes well within known bug families, and even hardware-backed defenses designed for years can give way when expert humans pair with a capable model.
    “This work is a glimpse of what is coming. Apple built MIE in a world before Mythos Preview. We’re about to learn how the best mitigation technology on Earth holds up during the first AI bugmageddon,” the researchers wrote.
    There is a quieter note at the end of their post worth keeping in mind. The Calif team mentioned that Apple’s hosts told them the spaceship campus cost roughly $5 billion. Asked about their own office, they said it came in well under $1 billion. The asymmetry is the entire story: small teams armed with capable AI can now do work that, until recently, required the kind of headcount and budget only a handful of organizations could field.
    Written by Alius Noreika
  6. New research led by the University at Buffalo has uncovered security flaws in more than 540 5G smartphone models worldwide that could allow attackers to disrupt service by exploiting a brief gap before devices confirm that a network connection is legitimate.



    “Every time you make a call, send a text or stream video on a 5G smartphone, the device exchanges a rapid series of configuration messages with a nearby cell tower, some of which are processed prior to the phone verifying the tower’s authenticity,” said lead research investigator Hongxin Hu, PhD, professor and associate department chair in UB’s Department of Computer Science and Engineering. “Our team found that this process creates an opening for malicious interference, exposing vulnerabilities that affect smartphones from every major manufacturer.”
    To address this risk, Hu and collaborators from UB and Texas A&M University developed an AI–driven testing framework called CONSET (Constraint‑Guided Semantic Testing) that detects these hidden weaknesses and helps manufacturers fix them before they can be exploited.
    AI vs. traditional testing
    The 5G standard that governs how phones talk to cell towers was developed by the 3rd Generation Partnership Project (3GPP) and spans thousands of pages of technical specifications. Within those documents are detailed rules describing how different parts of a phone’s configuration messages are supposed to work together. When those relationships aren’t implemented correctly in device software, subtle logic errors can slip through the traditional testing methods used by manufacturers.
    “In the past, testing often focused on crashing or disrupting phones by sending garbled or malformed messages. That’s essentially the digital equivalent of shouting nonsense,” Hu said. “Our approach with CONSET is different. We send messages that look normal on the surface but contain carefully crafted contradictions that violate the specification’s own rules.”
    CONSET relies on a large language model (LLM) – the same class of AI technology behind tools like ChatGPT — to read and interpret the 3GPP standards. The model extracts requirements from the standards’ natural-language sections, converts them into machine-checkable rules and generates targeted test cases to reveal hidden vulnerabilities.
    Using the AI framework, the researchers uncovered seven new vulnerabilities in commercial 5G smartphones, including three classified by industry as high severity. The confirmed flaws affect 64 modem chipsets – the components that handle cellular communication – used in 542 smartphone models. According to Hu, many of these flaws are buried in the gap between what the 5G standards require and how a device’s software interprets them.
    Industry response to the team’s discoveries
    The research team evaluated CONSET on eight commercial 5G smartphones across four major chipset families, delivering test messages wirelessly in a controlled laboratory setting. On devices with MediaTek and Qualcomm chipsets, the crafted messages triggered modem crashes and connection failures. In many cases, affected phones could not reconnect to the network without a manual reboot.
    MediaTek assigned three high-severity Common Vulnerabilities and Exposures (CVEs) and released patches. Qualcomm confirmed several findings, with additional issues under review. For their efforts, the researchers received $16,000 in combined bug bounty awards, which are payments companies offer for responsibly reporting security flaws.
    “An attacker using inexpensive radio equipment could set up a fake cell tower and crash nearby phones, cutting off calls, data and even emergency communications,” Hu said. “The good news is that, because we followed responsible disclosure practices, manufacturers were able to patch the vulnerabilities before they could be misused.”
    The team also tested CONSET on an open‑source 5G platform, where it identified 29 distinct crash points and produced detailed traces to guide developer fixes. Four of those issues have already been resolved, with additional remediation underway.
    More recently, the team discovered additional baseband system vulnerabilities affecting Apple and Google devices and is working with both companies to address them.
    Research receives global recognition
    The team’s study, “Semantics Over Syntax: Uncovering Pre‑Authentication 5G Baseband Vulnerabilities,” was recently accepted to the 35th USENIX Security Symposium, one of the world’s leading academic conferences on computer and information security, which will be held later this summer in Baltimore.
    The Global System for Mobile Communications Association has also formally acknowledged the team’s responsible disclosure and its contributions to strengthening the security of the global mobile ecosystem.
    “5G is the backbone of our connected world, from consumer smartphones to critical infrastructure,” Hu said. “This work shows that AI can play an important role in making that backbone more secure.”
    Source: State University of New York at Buffalo
    Related links:
    You can offer your link to a page which is relevant to the topic of this post.

Configure browser push notifications
Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.