News
-
GhostBSD 26.2 Released: Moves to FreeBSD 15.1, Gains a New Installer
The GhostBSD desktop operating system has been updated to version 26.2. It is now built on FreeBSD 15.1 and ships a new installer with support for GELI full disk encryption.
-
CISA adds Adobe Commerce and Brotli flaws to KEV as PolyShell hits hundreds of stores
CISA has confirmed active exploitation of two critical vulnerabilities, one in Adobe Commerce and Magento and one in Google's Brotli decoder library. The first has already been used to breach hundreds of online stores, and the second has prompted emergency updates from dozens of vendors.
-
Oracle PeopleSoft zero-day exploited by ShinyHunters turns out to be three chained flaws
Zero Day Initiative researchers found that the critical CVE-2026-35273 in Oracle PeopleSoft is really three linked bugs across two components. At its core is the product's default trust in its own loopback address.
-
Lexifina builds a "git" for the US Code
Lexifina has reconstructed the change history of the US Code the way git tracks code: every phrase is tied to the law that wrote it and the date it took effect. The motivation is that lawyers and language models alike confuse old and current versions of the law.
-
Wine Adds MESA_map_buffer_client_pointer Support for 32-bit OpenGL Under WoW64
Wine has merged support for a Mesa extension that makes OpenGL buffer mapping more efficient for 32-bit Windows applications running on 64-bit system libraries. The change lands in Wine 11.21.
-
Anthropic's IPO: VCs will make billions, but Amazon stands to make far more
Anthropic's IPO filing shows that no venture firm owns even 5% of the company. Amazon looks set to be the biggest winner, thanks to convertible notes that have multiplied in value over three years.
-
Delaware plan would let AI agents run entire businesses
The proposal would allow businesses to be run by AI agents with no human involved. Rep. Comer warns that owners could escape liability for "reckless" AI.
-
Parents sue OpenAI, saying GPT-4o helped their daughter secretly quit her seizure medication
The family of a 31-year-old Amazon engineer with epilepsy says ChatGPT drew up schedules for tapering her medication and told her to keep it from her doctors. She died in February.
-
Japan's GMO urges customers to shut down their PCs over ransomware threat
An attacker who breached the Onamae Desktop Cloud service threatened to trigger ransomware on customer servers. GMO refused to pay and asked users to disconnect and power down their PCs.
-
Google starts certifying third-party Android app stores, but not in the US
Google has opened applications for its Registered App Stores program, which will let approved third-party stores offer Android users easier app installs. The program does not extend to the US.
-
Microsoft ships out-of-band Windows updates to distrust eMudhra certificates
The KB5134133 and KB5134125 out-of-band updates remove seven certificates tied to eMudhra's compromised certificate authority keys from the Windows trust list. They target systems that don't receive automatic trust list updates.
-
UEFI firmware flaw enables code execution early in the boot process on servers
A critical vulnerability in EDK2 lets attackers run code while a system is still booting. According to Ars Technica, most servers in the world are at risk.
-
Quad9 Pulls Out of France Over Court-Ordered Site Blocking
The free DNS resolver Quad9 will stop serving users in France on November 24. The move follows a French court order requiring it to block sites accused of infringing a sports broadcaster's copyrights.
-
Google DeepMind unveils Genie 4: a world model with audio and real-time steering
The new model generates more realistic worlds, adds real-time sound, and lets users reshape a scene with text prompts mid-simulation. For now, Genie 4 is available only to trusted testers.
-
Senators accuse Trump administration of hiding a secret court ruling on spying on Americans
Ron Wyden and Adam Schiff say the administration is unlawfully withholding a FISA court ruling on search filters for intercepted data until Congress renews the Section 702 surveillance program.
-
Opera unveils WebAI, a standard for running AI models right in the browser
Opera has proposed WebAI, a new web standard that lets AI models run locally in the browser without relying on the cloud. The feature is already available as an early preview in Opera One.
-
Microsoft Authenticator Flaw on Android Let Permissionless Apps Steal Work Account Tokens
Microsoft has fixed CVE-2026-80097 in Authenticator for Android, which let a malicious app with no permissions pose as Teams and obtain tokens for a work account. Users should update to version 6.2606.4246.
-
Keystone to Destroy 18,835 Hardware Wallets After Device Verification Key Is Stolen
An attacker broke into crypto wallet maker Keystone's website and obtained the key its devices use to prove they are genuine. Owners' recovery phrases and private keys were not affected, but the protection against counterfeits was compromised.
-
Apple brings CoreGraphics zero-day fix to older iPhones and iPads
Apple has released patches for older iPhones and iPads that close a zero-day vulnerability in CoreGraphics. According to the company, the flaw was used in "extremely sophisticated" targeted attacks.
-
OpenAI's compaction feature could be abused to extract a model's hidden reasoning
Security firm Xint showed how the mechanism that shrinks long conversations in OpenAI's API could be turned into a way to pull a model's hidden reasoning out in plain text. OpenAI confirmed the issue and fixed it on October 23.
- More