Project Helix: a $1,200–$1,800 projection, not a price tag
Fortune's profile of new Xbox CEO Asha Sharma says the Helix console's price has internally been projected at between $1,200 and $1,800 for consumers, unless Microsoft subsidizes it. That is an internal estimate. It is not an announced retail price.
The profile adds several details about the plans:
- Sharma plans a next-generation handheld by the 2027 holiday season and the next console by the 2028 holidays.
- Windows and Xbox teams reportedly clashed over what software should run Helix. Windows leaders wanted the handheld to use a trimmed-down Windows Home. Xbox is now largely steering the operating system direction for the project.
- Sharma said of the project, "We can't build Helix on our own."
- Fortune cites Ampere Analysis's Piers Harding-Rolls, who said the biggest challenge for hardware makers is rising hardware cost.
- Fortune also reports engineering deadlines for Helix have reportedly moved up by several months.
Microsoft's own description is more modest. In a March 11, 2026 Xbox Wire post, Jason Ronald called Helix a next-generation first-party console. It is designed to play Xbox console and PC games, and it is powered by a custom AMD system-on-chip co-designed for the next generation of DirectX and FSR. Microsoft said it plans to ship alpha hardware to developers beginning in 2027 and wants to keep games from four Xbox generations playable. That post gives no retail price and no consumer launch date.
Two caveats about the roundup's framing:
- The South African figure: MyBroadband's R33,955 "after tax" conversion is its own calculation. I could not verify the exchange-rate and tax assumptions behind it.
- The name: "Xbox 5" is a headline label. Microsoft's name for the project is Helix.
My read is that a figure this high mostly shows how much memory and silicon costs are squeezing console makers. Whether Microsoft absorbs part of that cost is the open question. Windows enthusiasts should watch it because Helix is meant to blur the console and PC line, and the Xbox mode rollout to Windows 11 is part of the same strategy.
eMudhra: the one with immediate action for admins
This is the most practical item in the roundup. Mozilla's Dennis Jackson reported that on Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys for eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.
Google's Chrome team says the private keys were generated with insufficient randomness, so anyone could forge trusted HTTPS certificates against clients that still trust those CAs. Of the eight certificates, six were issued for TLS use and two for code signing.
What was blocked, and when
- Chrome: Chrome received the report at 18:05 UTC on October 17 and, by 19:45 UTC, had landed a CRLSet update blocking the affected keys. Chrome users were protected without a browser update or restart. Android devices got an equivalent update through Google Play Services.
- Firefox: Mozilla finished blocking the certificates through OneCRL at 22:59 UTC, with no update or restart required. eMudhra's statement adds that Mozilla shipped Firefox 158.0.1, plus ESR 115.43.1 and 153.5.1, for users whose custom settings blocked the OneCRL update. Mozilla also updated NSS to 3.131.1 to remove the root that signed the affected intermediates.
- Apple and Microsoft: According to the disclosure site tracking the incident, the certificates have been blocked in Apple devices since the 19th and on Microsoft platforms since the 20th.
Why Windows admins should still care
Revocation reaches browsers and platforms, but not every piece of software. As the disclosure site puts it, many other clients do not consume revocation information and need software updates to stop trusting the compromised intermediates. That includes tools that bundle their own trust lists. Go, for example, shipped a fix (CVE-2026-111943) in versions 1.26.10 and 1.27.3, rejecting chains that contain any of the eight keys.
A practical checklist:
- Confirm Windows is current, since Microsoft's block is reported as arriving on October 20.
- Update browsers, including Firefox ESR builds with custom policies.
- Update software that bundles its own CA lists, such as Go toolchains, Linux containers, and CI images.
- Treat any non-browser client that doesn't enforce Certificate Transparency or revocation as the likely gap.
Keep the risk in proportion
This is a compromise of intermediate signing keys. It is not a break of TLS itself. eMudhra says the affected intermediates are limited to those certificates and don't touch its root keys or other intermediates. It also says none issued end-entity certificates and only one was deployed in production. The researchers' CT-log analysis points the same way. According to the disclosure site, CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked. The weak spot is clients that don't enforce CT. There is no evidence in these reports of attacks against users.
The rest of the roundup
- Google Cloud outage: Google said a "power event" in its europe-west2 London region caused an outage that disrupted several UK financial firms and public-sector websites. Revolut said its customers' money and data were safe. Reuters-sourced coverage notes the UK brought Google Cloud, Microsoft, AWS and Oracle under direct regulatory oversight as critical third-party suppliers in July. Azure customers should read that as a reminder to plan for regional failure.
- Anthropic's finances: The Wall Street Journal, citing a draft IPO prospectus, reports a first-half 2026 net loss of $80.7 billion. About $72 billion of it is an accounting effect tied to convertible notes. The same draft reportedly shows planned spending of about $31 billion on Microsoft contracts. These are unaudited draft figures reported by the WSJ, not final public results.
- Starlink in Ukraine: Reuters says it could not verify the WSJ's claim that Musk ordered a slowdown of military-grade Starlink service. Attribution is disputed. Earlier reporting pointed to the White House, and Musk has said limits were set by the U.S. military or president. Treat this as an allegation.
Bottom line
The Xbox number is a projection with a subsidy escape hatch, so don't budget for it yet. The eMudhra incident is the part to act on today. Browsers and Windows have been patched, but anything with its own trust store needs checking.