Firefox 157 is out for Windows, macOS, Linux, and Android and the biggest change in this version is the new Nova design, which brings a more modern look to the browser. Mozilla has also fixed over 70 security vulnerabilities, and updates are also available for the Firefox ESR versions.

The release of Firefox 158 is scheduled for October 13th, 2026.

What’s new in Firefox 157?

Now that Firefox has adopted a two-week release cycle, major new features are growing fewer and farther between. With Firefox 157, the focus is on the new Nova design, which has heavily rounded corners and subtle color gradients on surfaces. You’ll find 12 themes, each in light and dark variants.

Mozilla has also brought back the popular Compact Mode, which groups elements together to save space—great for smaller screens.

You can learn more about the Nova redesign and what it entails in this announcement post by the Mozilla team.

Security fixes in Firefox 157

In the security advisory for Firefox 157, Mozilla lists 76 vulnerabilities that have been fixed, 30 of which were discovered and reported by external security researchers.

Mozilla classifies 38 vulnerabilities as high risk, 29 as medium risk, and nine as low risk. Among them, 32 are use-after-free (UAF) vulnerabilities, some of which could be exploited to inject and execute code, and 15 of which could be exploited to escape the browser sandbox.

Firefox ESR updates

In addition to Firefox 157, Firefox ESR releases 153.4.0, 140.17.0, and 115.42.0 are also now available. However, the latter are only available for Windows 7 and 8.1 and macOS 10.12 to 10.14 until March 2027.

In the ESR versions, Mozilla has fixed the aforementioned vulnerabilities that were also present in the code of these earlier browser generations. That amounts to 62 vulnerabilities in Firefox 153.4.0, 43 in Firefox 140.17, and 31 in Firefox 115.42.

Firefox ESR 140 received its final update on September 29th. In two weeks, this version will finally be replaced by Firefox ESR 153. If you haven’t already done so, it’s time to start planning the switch.

Passwords? Left behind in the dust. You’ve moved on to passkeys—but you may not have locked them down properly.

Most people use their phones, password manager, or PC to store passkeys. Each has their advantages, but they should be secured in slightly different ways. You may also not have covered your butt in the event you ever lose access to those devices.

Here’s how to get everything in order.

Cloud-saved passkeys

If you save your passkeys to your phone or an independent password manager, they live in the cloud. Same goes for if you save them while logged into a Microsoft account in Edge or a Google account in Chrome.

Because passkeys stored in the cloud can be used across devices, you must safeguard the account holding them to prevent misuse. Set a strong, random, and unique password + two-factor authentication.

Also be smart about which cloud-based password manager you use. Independent password managers may not be as vulnerable (or targeted) as Google’s, which can end up exploited if you’re logged into Chrome. (A attack of this sort has already happened, with successful use of stored passkeys.)

Device-bound passkeys

The easiest way to avoid putting your passkeys in the cloud is to save them to your Windows PC. You’ll be required to set up Windows Hello to protect them. I recommend at least a 6-8 digit PIN, if you don’t use biometrics.

A dongle like a YubiKey or Google Titan Security Key can also securely hold passkeys offline. To lock one down, you’ll create a PIN. The minimum recommended is 6 digits—when asked, Yubico spokesperson Ryan Schin said, “The recommendation would generally be a 6-digit PIN length for all YubiKeys for greater security.” (In fact, business-specific YubiKeys actually require it.)

Worried that’s not enough? Then specifically choose a YubiKey, which will require a full wipe and reset after eight failed PIN entries. This feature protects against brute force attacks (trying multiple combinations of PINs over and over). 

Make backups!

A passkey is like a house key—if you only have one and you lose it, you end up locked out. But in this case, no one can reset the lock or otherwise pry the door open.

You’ll want to create extras, as backup. Additionally, you may want to consider leaving one with a trusted contact in case of emergency.

How? If you have cloud-based passkeys, create an additional one on your PC or hardware security key. The security keys start at $30 to $35, making them relatively inexpensive. You can even pick up YubiKeys from local retailers like Best Buy.

Alternatively, ensure you at least have access to another device logged into the account with the cloud-based passkeys. One easy, cheap option is to use an old phone, ideally one still getting modern security updates. 

As for device-based passkeys, I always recommend having one on at least two different security keys or one PC and one security key. More is better.

A viral social media post claims Windows 11 stores a preview of every photo ever deleted. The controversy centers around a well-known Windows feature called the thumbnail cache, which can still contain image thumbnails long after their original files have been deleted.

The discussion was sparked by user @Ayzacoder, which has been viewed millions of times over the last few days. However, the claim is only partially correct—while Windows 11 can store thumbnails of deleted images, not every image will automatically end up in this cache.

Windows keeps a thumbnail of every photo you've ever deleted.

It sits in a file called thumbcache_256.db, and forensic examiners pull it routinely. There are 15 more stores like it.

Here's how to find them and wipe them:

— Ayzaa (@Ayzacoder) September 26, 2026

What is the thumbnail cache?

Windows 11 creates thumbnails for photos, videos, and some document types so that they can be displayed more quickly in File Explorer. Instead of recreating the preview every time it’s needed, the operating system stores it temporarily in a local database.

This data is stored in the user profile at %LocalAppData%\Microsoft\Windows\Explorer. There you’ll find files with names such as thumbcache_32.db, thumbcache_96.db, thumbcache_256.db, or thumbcache_1024.db. These are individual thumbnail databases containing preview images in different sizes.

This thumbnail cache system has been in place since Windows Vista. Previously, Microsoft used the familiar Thumbs.db files convention, which were stored in individual folders.

Not every deleted photo is saved

The claim that’s circulating social media right now gives the impression that Windows 11 automatically archives a preview of all deleted images. However, there’s no evidence to support this.

For example, a test conducted by Windows Latest showed that several images that were downloaded and later deleted didn’t appear in the thumbnail cache. The database files weren’t altered at all.

The reason? A thumbnail preview is normally only saved when File Explorer (or another application) generates a thumbnail as part of the file preview process. If an image is never actually displayed as a preview anywhere, it won’t have made a thumbnail to end up in the cache.

Why do thumbnails remain after deletion?

The thumbnail cache is stored separately from the original image files. That means when an original photo is deleted, Windows 11 doesn’t automatically remove the corresponding thumbnail.

As a result, small image previews may still be present even though the original file itself has long since been deleted from the PC.

Investigators make use of the data

The thumbnail cache has been of interest to IT forensic experts for years. Using specialized tools, stored thumbnails can be extracted from these databases even after the original files have already been deleted.

This doesn’t automatically pose a security risk for home users. However, it does show that “file deleted” doesn’t necessarily mean that all associated information is completely wiped from the system.

Should you worry? That depends. Since these are thumbnails, they aren’t complete copies of the original images but rather reduced-size previews. A lot of the original detail will be lost, and whether the thumbnail remains recognizable will depend on the size and subject of the image.

How to clear the thumbnail cache

If you want to remove existing thumbnails from your Windows 11 PC, you can do so using the built-in thumbnail cleaner:

1. Press the Windows key + R keyboard shortcut.
2. Type “cleanmgr” and press Enter.
3. Select the Windows drive.
4. Tick the “Thumbnails” box.
5. Click “Delete files.”

Windows 11 will then remove the stored thumbnails. The cache will be rebuilt as required whenever you browse folders later.

In Windows 11 Pro, Enterprise, and Education, you can also permanently disable thumbnail caching. To do this, open the Group Policy Editor (gpedit.msc) and navigate to User Configuration → Administrative Templates → Windows Components → File Explorer. There you will find the policy called “Disable thumbnail caching.” Microsoft recommends enabling this setting on public computers, shared computers, or any computer where security is a key concern.

Users of Windows 11 Home can instead enable the option “Always show icons instead of thumbnails” in File Explorer. This means that image previews will no longer be displayed and, consequently, no new thumbnail previews will be created.

Back in February, Discord first attempted to launch its age verification process—only to run straight into massive user outcry. In response, the company went back to the drawing board. Now, half a year later, the branding of teen and adult accounts has finally rolled out.

As a regular Discord user, I wasn’t sure what to expect from the process. So, while waiting my turn, I read up on what I needed to know.

You can’t opt out

Discord first framed age verification on the platform as a move to protect teens. Problem was, it expected users to submit to a facial scan or upload a government ID. That sparked protest—and rightfully so, given today’s greater privacy and security concerns.

Now Discord has easier methods to prove adulthood, if you somehow get flagged as a teen. But you can’t escape the classification process. Multiple countries have begun requiring companies to confirm the ages of users, in order to protect children from harmful content and exposure to unsafe adults.

The only true way to opt out is to leave the platform all together.

Verification is now less invasive

If you stick around, Discord automatically assigns you an age group based on what it calls “signals.” Using machine learning, the platform guesses your age based on details like how old your account is, who you speak with the most, the servers you belong to, and if you’ve ever subscribed to Nitro. Discord says it does not read your messages (either those sent on servers or over direct message) as part of its evaluation.

According to Discord, this method will accurately assign an age category to over 90 percent of users. If it doesn’t, adults can prove their age through credit card info, the Apple App Store or Google Play Store, Google Wallet, or AgeKey. (AgeKey is a service owned by Singaporean age verification company k-ID.)

Discord says its third-party vendors for age confirmation must abide by its data retention policies. Namely, any age verification related data can only be kept for the time needed to confirm age, then must be deleted after. If facial age estimation comes into play, it can only be performed on your device.

You can choose not to verify

Still don’t want Discord to have any further information about you in order to escape classification as a teen? You can still keep using the platform, but your access will be more locked down.

Teen accounts are restricted from age-gated servers, content, and settings. Messages with sensitive content may be blurred or all together blocked, depending on the source. Direct messages from non-friends will automatically be sent to a message request inbox, allowing you to screen them before they appear in your normal DM list. (For the full details on Teen protections, you can read Discord’s full rundown.)

Perhaps a small benefit: Discord is now enabling “spoiler channels,” which will let server owners sequester juicy info without having to age-lock them. (AKA the long-standing workaround.)

Where to check your status

Head to Settings > Account. Under Account Status, you’ll see “Age Group.” Your status will be listed as either Teen or Adult.

Anecdotally, users on PCWorld’s The Full Nerd Discord server have reported getting Adult status—and just before I filed this story, I received the same designation, too. So Discord may end up being right about its high estimates for accurately pinpointing “mature” behavior.

(We’re all still emotionally unsure it was correct, though.)