Welcome to Tech Beat, your daily look at what's moving in technology.
Security researchers have uncovered a zero-click stored cross-site scripting vulnerability in Next.js, the widely used web framework. The flaw works through reflected headers and requires no user interaction to exploit, meaning attackers could potentially compromise sites built on Next.js without victims doing anything at all. It's a reminder that even trusted infrastructure carries hidden risk.
Shifting gears, a new study from Surfshark finds that ninety percent of popular messaging apps now incorporate artificial intelligence features that researchers say put user privacy at risk. Signal remained the standout exception, collecting minimal data. The findings raise a familiar tension: the more an app learns about you to serve you better, the more there is to lose if that data is mishandled.
And on a lighter note, Apple Maps has quietly expanded its web presence, with maps dot apple dot com now more broadly accessible. For years Apple's mapping service was essentially locked inside its own devices, so opening it to any browser is a meaningful shift in strategy — one that puts it more directly in competition with Google Maps on Google's own turf.
That's your Tech Beat for now. Keep surfing. Tech Beat out.
