Bitget blames North Korea for $387.5M crypto wallet raid

The CEO of crypto exchange Bitget has confirmed that a cyberattack with all the hallmarks of a North Korean operation resulted in approximately $387.5 million worth of digital assets being stolen from the exchange’s wallets. Bitget initially estimated the loss at $351.6 million, but later revised the figure to $387.5 million after identifying additional affected assets on Zcash and TRON that were not included in the initial estimate. Blockchain intelligence company Arkham published its preliminary observations of the attack, estimating at the time that roughly $350 million was stolen and that $228 million left Bitget’s wallets in 18 minutes, between 18:58 and 19:16 UTC. Arkham said $153 million worth of XRP was taken from a wallet it identified as a Bitget cold wallet, while the stolen assets also included $66.2 million of ETH, $34.8 million of USDT, $12.9 million of USDC, and $12.8 million of Tether Gold on Ethereum. Other affected networks included Arbitrum, Optimism, BNB Smart Chain, Avalanche, and Base. However, Chen said Bitget's cold wallets and customer balances remained unaffected, while its User Protection Fund held more than $464 million worth of assets. “To be transparent about our financial position: beyond the $464M+ Protection Fund – all held in publicly verifiable wallets – Bitget holds over $1 billion in its own assets,” Chen said. “User funds are covered on a 1:1 basis.” Chen also explained that Bitget Wallet, the company’s self-custody product, operates on infrastructure separate from its exchange, and Bitget users can still make deposits and trade their tokens, despite withdrawals being temporarily suspended while additional security checks are completed. Bitget said it also engaged incident response giant Mandiant and blockchain security outfit SlowMist to help with the investigation into the attack. Chiefs at fellow exchanges rallied around Bitget in support. “MEXC stands ready to support Bitget in any way we can,” said CEO Vugar Usi. “In moments like this, the industry is stronger when we stand together.” Binance co-CEO Richard Teng also pledged Binance's support for Bitget, saying it had shared intelligence and helped trace the stolen funds. Ben Zhou, CEO of Bybit, said his company was on standby to “help in any way we can,” noting that Bitget helped it out following the $1.5 billion Bybit theft the FBI attributed to North Korea in February 2025. How and who Root cause analyses typically take some time, although according to Chen, Bitget's security team has already identified the wallet service's backend system as the source of the unauthorized transfers. “Hackers breached a key backend system of the wallet service and exploited it to forge transfer information and invoke the authorization signing process, thereby transferring funds out,” she said. “The possibility of private key leakage can be ruled out – this means a more severe risk scenario has been eliminated. Damage control has been confirmed as complete, and there is no risk of further fund outflows from the platform. “The specific intrusion methods used by the hackers are still under technical investigation, and a full report will be released upon completion of the investigation.” Chen did not go into too much detail about the alleged links to North Korean state-sponsored attackers having a hand in the attack, but said “IP behavioral patterns and on-chain signatures” suggest it was Kim’s cronies at work. It would come as little surprise if North Korea was indeed the culprit behind the attack. The regime has a knack for hacking crypto exchanges. The aforementioned hit on Bybit was perhaps North Korea’s biggest crypto haul, although similar lucrative ventures attributed to North Korean attackers have come at the expense of DMM Bitcoin and WazirX, among others. Bitget was founded in 2018, registered in the Seychelles in 2022, and operates through regional hubs across the world. Some netizens have speculated that the timing was especially inconvenient, with the transfers detected at 18:31 UTC – 02:31 on September 25 in Singapore and China, the first day of China’s three-day Mid-Autumn Festival holiday. The festival is also widely celebrated in Singapore, although it is not a public holiday there. The Register asked Bitget whether this played a role in the attack and its remediation but it did not respond. As of Friday, Bitget is offering bounties to those who help freeze or recover the stolen funds. It said eligible participants could receive 5 percent of the funds their efforts successfully freeze or recover.®

source https://www.theregister.com/cyber-crime/2026/09/25/bitget-blames-north-korea-for-3875m-crypto-wallet-raid/5299218

Read More

Elementor WordPress flaw lets attackers create admin accounts

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]

source https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/

Read More

Meta's new AI fidget is a ... Tamagotchi?

Meta became the latest to dip its toes into the fraught world of hardware AI widgets this week after it unveiled a Tamagotchi-sized handheld AI companion called the Muse Charm. The Social Network now joins several hardware startups which have attempted to use handheld devices to bring agentic AI to a more mainstream audience. The Humane AI pin and Rabbit’s r1 are just two examples. The Muse Charm follows a similar trajectory. The handheld device appears to be roughly the size of an Apple Watch and features a cute, inoffensive teddy bear shaped avatar that will communicate through voice interactions with the user. Meta’s choice of avatars here may have been influenced by the “sensual” chatbot controversy involving underage youths earlier this year. What sets Meta apart from many AI hardware startups is that it has direct control over the hardware, software, and models used. Many early AI widgets relied on off-the-shelf models from the likes of OpenAI. Meta hasn’t said which of its Muse models will run on the device, but given its diminutive size, we suspect, at most, it’ll run voice-to-text and text-to-speech models locally while the avatar’s responses will be generated by its Muse LLMs running in the cloud. Meta’s Charm is expected to ship for Christmas just in time to relive the nostalgia of unboxing your first Tamagotchi. We can only hope that Muse Charm’s avatar won’t die from neglect if you take a break to escape the AI hype cycle and touch some grass. Pricing, which could make or break a tchotchke like this, remains a mystery. It’s also unclear what value over a standalone app it might provide. Most folks these days carry a perfectly capable slab of glass and silicon in their pockets everywhere they go. This was a common criticism of the Rabbit R1. While the physical form factor had its charm, many felt it was an expensive gimmick that could have been an app, which Rabbit launched this week. Of course Meta isn’t the only major model dev searching for a Trojan horse to get the general public hooked on their AI models. OpenAI has tapped famed Apple designer Jony Ive to design its first AI handheld. Meta does have the advantage of having built physical hardware before, which has clearly given it a head start not only on handheld AI assistants and wearables, but also on the privacy headaches that come along with them. Strapping cameras to people’s faces, perhaps to no one’s great surprise, has enabled abuse, while Meta’s glasses have earned the less-than-flattering moniker “pervert glasses.” This public relations debacle has led Meta to release a new version of its Meta Glasses that ditches the camera entirely, but it seems just on that one model. ®

source https://www.theregister.com/personal-tech/2026/09/24/metas-new-ai-fidget-is-a-tamagotchi/5298936

Read More

MacSync malware uses public iCloud calendars to deliver new payloads

A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...]

source https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/

Read More

New Carbonato malware uses AI agents to hijack exposed Docker hosts

A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]

source https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/

Read More

An Epyc trip to Venice: Everything we do and don't know about AMD's 256-core monster chip

AMD's Venice Epycs mark the chipmaker's biggest architectural shift in CPU design since Rome made its debut all the way back in 2019. What's more, AMD's Zen 6-based product stack is shaping up to be the broadest CPU portfolio ever, spanning general purpose, HPC, AI, and eventually consumer platforms. AMD isn't quite ready to spill all the beans on its 6th-gen Zen cores, but at this point there's less we don't know about Venice than we do. Late last week, AMD gave us a bit more to chew on with a whitepaper [PDF] clearly aimed at quashing marketing juggernaut Nvidia's narrative around its Vera CPUs. We'll dive into the performance claims raised in the white paper in a bit, but given the piecemeal release of info on Venice up to this point, we figured it was time to take a closer look at the CPU architecture that will underpin AMD's roadmap for the next few years. A little bit of everything Broadly speaking, AMD's 6th-gen lineup can be broken down into four buckets — high-performance, enterprise, HPC, and AI — each with its own quirks. We'll kick things off with AMD's performance-optimized parts because those are the ones that will actually ship in 2026. Pretty much everything else will be rolling out over the course of 2027. The Epyc 9006 SP7 platform is what AMD has really been talking about for the past year. It's the one that'll offer up to 256 cores, 16 channels of DDR5, and 128 lanes of speedy CXL 3.1-compatible PCIe 6.0 connectivity. But those are just the headline specs and just like last year's Turin parts, Venice will actually come in two distinct flavors: density-optimized and frequency-optimized parts. The 256-core version, if you hadn't already guessed, is the density optimized part. Alongside it, AMD has a 96-core part capable of boosting to 5 GHz in the works. Peeling back the heat spreader, we see how AMD has managed this. Both chips feature a pair of I/O dies surrounded by eight core-complex dies (CCDs). That's twice the I/O but half as much compute silicon as we saw in Turin, yet core counts are up. But depending on the chip, these CCDs are wildly different. For this generation, AMD has doubled the number of compute cores per chiplet to 32 and quadrupled the shared L3 from 32 MB per chip to 128 MB. That means AMD's fully loaded Venice CPUs now boast a gigabyte of L3 onboard. For the frequency-optimized parts, AMD has played things a little safer. Core counts and L3 caches are only up about 50 percent over last gen at 12 cores and 48 MB of L3 per chiplet. The higher core counts afforded by AMD's new chiplets are neat, but arguably the more interesting change is the cache hierarchy — there is no longer any difference between a Zen 6C core and a Zen 6 core aside from clock speeds. In prior generations, AMD's ZenC CCDs shared the same 32 MB pool of L3 as its standard Zen CCDs, which meant its top spec parts had half as much L3 per core as its higher clocking, but lower core-count parts. This is no longer the case with Venice. Regardless of which CCD is being used, there is at least 4 MB of shared L3 per core feeding it. The only difference now, it seems, is a choice between core count and core density. This is about the time we have to remind folks that AMD's compact Zen cores are not the same as Intel's efficiency cores. Intel uses completely different microarchitectures with different feature sets and cache hierarchies for its P and E cores; AMD simply trades clock speed for a more compact form factor — the ISA is identical. With that out of the way, let's talk I/O dies because this is another change. As we mentioned earlier, there are now two of them. If we had to guess, the reason for this comes down to the interconnect used to connect the CCDs to the I/O subsystem. If you hadn't noticed, the dies are butted right up against each other this time around. In any case, the I/O itself is largely unchanged. We get 128 lanes of PCIe connectivity — the same as the last few generations of Epyc. Those lanes are, however, twice as fast thanks to the bump from 5.0 to 6.0 connectivity. The chips also add support for CXL 3.1 connectivity, which means customers will now be able to take advantage of memory god boxes to pool and share memory between them. We discussed this tech at length here if you are curious about how these network-attached memory appliances work. Along with faster I/O, the dies add support for 16 channels of DDR5 8000 MT/s or 12,800 MT/s memory using MRDIMMs. This gives Venice a whopping 1.6 TB/s of memory bandwidth, nearly 3x that of Turin, and in real world testing, AMD says it can hit roughly 1.3 TB/s in STREAM Triad, a time tested benchmark for evaluating bandwidth. We still don't have all the details on AMD's Zen 6 microarchitecture, but we do have a largely complete list of its SP7 lineup, which we've included below. AMD's Epyc X-chips are back Before we move on to AMD's more mainstream Epyc offerings, we should talk a bit more about its HPC centric Venice-X parts, which share the SP7 socket, but push L3 cache per core to 12 MB or 1,152 MB per socket. As with past X chips, AMD achieves this by stacking SRAM on top of its CCDs using its 3D V-Cache packaging tech. This is the same tech used in consumer parts like the venerable 5800X3D and 7800X3D. For Venice-X, AMD is sandwiching up to eight 96 MB SRAM tiles between its 12-core CCDs and the package for a total of 144 MB of L3 each. This added cache makes these chips particularly attractive for HPC-centric workloads like computational fluid dynamics, finite element analysis, electronic design automation, and other scientific and engineering workloads. The chip is a return to form in many ways for AMD, which had skipped the X variant for the Turin generation. With that said, compared to its last Epyc X-chip, the new one won't offer any higher L3 cache capacity or core count. What Venice X will do is offer substantially higher clock speed, reaching as high as 5.15 GHz thanks in part to putting the SRAM tile under the CCD instead of on top of it. Enterprise Everything we've talked about up to this point has been aimed at high-performance and HPC applications — not what most enterprises will end up buying. For the more mainstream use cases, like storage, database, or virtualization servers, AMD will offer a cut down version of its Venice Epycs with anywhere from eight to 128 cores and eight channels of DDR5 memory. While memory bandwidth is a major bottleneck for AI and HPC, it's not nearly as important for most enterprise applications, so it makes sense to cut back here. In fact, Intel did the same thing with its Xeon 6 6700P series parts, which also topped out at 8 channels. From the die renders we've seen, AMD appears to be using a slightly different I/O die, which makes sense considering it doesn't need to deal with nearly as much data. They will also use a different SP8 socket, but will use the same CCDs used in the SP7 parts. The eight core part is a curious decision considering that the minimum core count per CCD is now 12, but it wouldn't be the first time that we've seen AMD bin silicon to offer greater segmentation by fusing off cores. Meanwhile the 128 core part will use four 32 core CCDs to hit its core count target. As you might expect, AMD's 9006 SP8 lineup is quite a bit bigger, spanning more than 20 SKUs with clock speeds up to 5 GHz, so while you may give up some memory channels opting for the parts, you aren't necessarily giving up any compute performance. Here's a full rundown: AMD puts Vera in its crosshairs Venice won't be the only chip AMD launches with its Zen 6 cores under the hood. While its first-gen Helios racks will use a 96-core Venice part and standard DDR5 DIMMs, future designs will use a very different CPU that more closely resembles Nvidia's Vera. Codenamed Verano, the chip will feature up to 72 cores (presumably spread across six 12-core chiplets) clocking to 5 GHz, but instead of DDR5 it'll feature 24 channels of LPDDR5x memory along with speedier 112 GT/s xGMI links, which AMD says should help with CPU-to-GPU connectivity. Vera for reference has 88 cores and packs up to 1.5 TB of LPDDR5x good for 1.2 TB/s of bandwidth. AMD is positioning the part, which is set to launch in the second half of 2027, as an ideal host processor for GPU servers. From what we gather, the decision to go with LPDDR5x over DDR5 RDIMMs largely comes down to power. The LP there does stand for low power. AMD hasn't said much about the chip's I/O die, but we suspect the real magic will actually lie here. Perhaps we'll see a stripped down I/O die with only what's necessary to support two to four GPUs? By cutting the power consumed by the CPU, AMD can free up capacity for more or faster, hotter GPUs allowing it to compete more aggressively with Nvidia on value. Venice vs Vera In AMD's most recent whitepaper, the company offered a counterpoint to Nvidia's own performance claims, which had shown Vera's Olympus core delivering a 1.7-1.8x uplift in per-core performance over Turin, a part we'll remind folks launched nearly two years ago. According to AMD, across the same four SPEC 2026 benchmarks, its 96-core Venice delivered between one and 12 percent higher performance than Vera, while in SPECrate 2026's Integer bench, its Zen 6 supposedly pulled ahead with a 20 percent lead. Finally in terms of throughput, what we assume was AMD's 256-core part predictably trounced the 88-core Vera, delivering a 2.24x advantage. No real surprise here. More cores usually equate to higher throughput. Take these claims with a grain of salt. — vendor supplied benchmarks are notoriously easy to cherry pick — but our takeaway is actually quite simple, and probably not the one AMD might have hoped for. AMD's own benchmarks show Vera's Olympus cores to be surprisingly competent in at least some benchmarks — AMD just has more of them per socket and more SKUs to address a broader range of use cases. CPUs are rarely a winner in all scenarios. We have little doubt that Vera will excel in some workloads and Venice others. We'll say it again, but there has never been one CPU to rule them all in the datacenter and there never will be. Of course, Nvidia isn't AMD's biggest rival in the datacenter CPU space. That would be Intel. Lucky for the House of Zen, it won't have much competition from Chipzilla this time around, at least not in the volume enterprise market. As we discussed last month, Intel's Diamond Rapids Xeon 7 processors will offer surprisingly comparable specs with up to 256 cores and 16 channels of speedy DDR5 and MRDIMM capacity. But unlike prior generations, they are entirely HPC-centric parts — no SP SKUs this time around. So, while Intel could pose a challenge on the very high end, AMD will have the volume advantage through much of 2027. What Venice tells us about Zen on the desktop With all of that out of the way, let's take a look at what AMD's latest Epycs tell us about its next generation of Ryzen and Threadripper products. Historically, AMD's Ryzen desktop processors have recycled CCDs from Epycs or vice versa. Assuming this doesn't change and AMD manages to cram two CCDs into an AM5 socket, we're likely looking at between eight and 24 cores on the desktop platform. That's assuming AMD only uses its frequency-optimized chiplets. It could push core counts to 32 if it opted for a single density-optimized CCD, though we have our doubts. Clock speeds are the open question, but with Zen 5 topping out at around 5.7 GHz, 6 GHz boost clocks shouldn't surprise anyone. AMD's Ryzen processors have traditionally used different I/O dies and there's no reason to think its 10,000-series — or whatever they end up calling them — will be any different. We can only speculate on PCIe lanes and chipset features, but it's safe to assume DDR5 8000 MT/s should be stable. With that said, given the current memory shortage, memory that fast may be a bit of a white whale for enthusiasts. Again, we're only speculating. AMD could go in an entirely different direction with its next Ryzen release. It would just be highly unusual. Threadripper is a bit easier to pin down. The parts historically have been unlocked Epycs, usually with higher boost clocks out of the box. AMD's next Threadripper refresh will undoubtedly deliver 96 Zen 6 cores clocking in excess of 5 GHz, more PCIe than you could ever hope to consume, and memory capacities that would require taking out a second mortgage even to entertain. The question it seems will be whether we'll see AMD deploy its Zen 6C cores on Threadripper for the first time. They'd easily put 128 cores within reach of desktop users for the first time, but it would also mean making concessions on per core performance and outside of a handful of occupations, the number of users that actually need that compute on their desk is likely pretty small. Nonetheless it'd be a sight to behold. Still questions left unanswered As Epyc release cycles go, Venice has been a rather unusual one. We still don't have a clear picture of the architectural changes that underpin the Zen 6 core or CCDs, nor has AMD spilled the beans on why the packaging looks so much different than prior generations of Epyc processors. Yet, we have comprehensive SKU lists, deep insights into the chip's composition, clock speeds, and preliminary performance figures relative to AMD's main competition this time around. We're hoping for more information on the Zen 6 core later this year, closer to when the first Venice CPUs begin shipping out to customers. ®

source https://www.theregister.com/systems/2026/09/23/an-epyc-trip-to-venice-everything-we-do-and-dont-know-about-amds-256-core-monster-chip/5298614

Read More

Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...]

source https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/

Read More

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]

source https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/

Read More

Sweden fines Miljödata $183,000 over breach affecting 2.2 million

Sweden's data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a breach in August 2025 affecting 2.2 million people. [...]

source https://www.bleepingcomputer.com/news/security/sweden-fines-milj-data-183-000-over-breach-affecting-22-million/

Read More

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]

source https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/

Read More

ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach

The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants. [...]

source https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/

Read More

New ClosedQuorum Windows malware uses AI for attack decisions

A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. [...]

source https://www.bleepingcomputer.com/news/security/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/

Read More

Let’s stop debating the GnuImp Manipulation Program

The GIMP will never magically become software beloved by artists—not without radically changing its culture, and making the artists the ones who call the shots. The GIMP will remain what it has always set out to be: a tinkerer’s toolbox, more concerned with the purity of its software politics than with garnering a loyal userbase of photographers and designers.

But because everyone insisted to poise it as a viable Photoshop killer, Linux is left with an obvious hole in its software offering, a hole nobody managed to fill with their own challenger.

↫ Aria Salvatrice

Excellent article, and spot-on conclusion.

source https://www.osnews.com/story/145997/lets-stop-debating-the-gnuimp-manipulation-program/

Read More

Microsoft to retire Microsoft 365 Companion apps in December

Microsoft will retire the Calendar, People, and Files Microsoft 365 companion apps on December 16 and has asked admins to remove them from managed devices. [...]

source https://www.bleepingcomputer.com/news/microsoft/microsoft-to-retire-microsoft-365-companion-apps-in-december/

Read More

Boss bought cheap 'printer' from a catalog and was left without a leg to stand on

Working in tech can produce a catalog of woes, and each Monday The Register shares yours in "Who, Me?" – our reader-contributed column chronicling tech-related mistakes, heartaches, and back-breaks. This week, meet an Italian reader we'll Regomize as "Marco," who took us back to what he called "The Roaring Nineties, when big computer companies sold pretty much everything, from graphics workstations to enterprise laser printers." They sold it all through hefty paper catalogs, because this was before broadband and Marco's company had only a 19k baud dial-up connection. Marco's boss, whom he described as a "sciagurato" – Italian for a wretch – kept one of those catalogs on his desk. "He perused it every day, like a kid waiting for Christmas," Marco told The Register. "One day he found an exceptional laser printer at almost one-seventh the cost. It was such a good a deal he ordered two of them." Marco said the boss told anyone who would listen that this feat of cost-cutting would surely propel him out of the tech team and into management. "The wiser among us were already counting the days until the disaster," Marco wrote. Disaster duly arrived with the delivery. "When the courier delivered the printer, it came in two huge packages, but not big enough for a laser printer," Marco observed. After wrestling with the packaging, the horrible truth emerged. "Our boss had bought two laser printer stands," Marco wrote, "because the catalog showed the stands with the printer on top." The company therefore had two stands and no printers. The boss's claim to promotion-worthy procurement prowess had collapsed. "We promptly hid the two pieces of junk in the darkness of our 'obsolete hardware store' and they are probably still there," Marco wrote. He suspects they are not alone, but surrounded by "other good deals, all waiting for the mercy of incineration." Have you or a colleague ordered the wrong thing? If so, click here to send your story to Who, Me? We'll put it on display rather than hide it in the back room. ®

source https://www.theregister.com/personal-tech/2026/09/21/boss-bought-cheap-printer-from-a-catalog-and-was-left-without-a-leg-to-stand-on/5297373

Read More

Chinese memory-maker CXMT claims DRAM production breakthrough

ASIA IN BRIEF Chinese memory-maker CXMT, whose products Apple has reportedly evaluated to use in the iPhone, claims to have made a miniaturization breakthrough. The company on Sunday posted news that it has started mass production of chips made with a fifth-generation process that essentially doubles memory density, meaning it can cut twice the number of dies for memory chips from a single wafer. CXMT says its key breakthrough is a high-k dielectric metal gate process – a way of insulating silicon to improve efficiency – adapted to baking DRAM. The company claims its new process puts it on par with rival memory-makers. The proof of the pudding is apparently a pair of LPDDR5X memory modules for smartphones or other high-end consumer electronics. Both products boast 24GB of memory. If CXMT’s claims of improved density and mass production are correct – and the new products aren’t too pricey – it’s good news for Chinese electronics manufacturers who, like their global peers, are struggling to source affordable memory thanks to supply chain crunches caused by demand for AI-related products. That shortage recently saw Apple hike iPhone prices by $100 and led the GSM Association to warn that rising smartphone prices threaten to slow digital inclusion. Democratic governments, however, are mostly uncomfortable with allowing their smartphone manufacturers to use Chinese components. India starts charging fees for instant payments India’s National Payments Corporation (NCP) last week introduced fees to use its Unified Payments Interface (UPI) for the first time. UPI is an instant payment scheme provided by India’s government. It allows transfer of funds between participants, which include over 700 local banks and many e-wallet providers. It also allows person-to-person payments. The scheme is a ubiquitous option even at small retailers across India, and one of the world’s busiest payment schemes with over 24 billion monthly transactions. The scheme is so popular that other payment providers outside India have adopted it so that Indian tourists can use it abroad. UPI launched in 2016 and has until now been free for shoppers and merchants alike. The NCP last week announced it will soon require merchants to pay 0.4 percent fee for when taking payments above 2,000 rupees (£15; $21). India’s government said the charge is needed to fund the operation of the scheme, the cost of which is currently borne by the nation’s government and participating financial institutions. The government ordered merchants not to pass on the fee. China’s online reach is surprisingly short, researcher finds China’s share of content distribution networks is small, leaving Asian nations largely dependent on US companies. That’s the key finding of research by Jason Hung, a quantitative sociologist and research fellow at the Internet Society’s Pulse program. Hung looked up the top 1,000 most popular websites in ten southeast Asian countries (Cambodia, China, Indonesia, Lao PDR, Malaysia, Myanmar, Philippines, Singapore, Thailand, and Viet Nam) using Google’s Chrome User Experience Report (CrUX), then used three different CDN and IP infrastructure lookup approaches to identify the company and jurisdiction serving the content. “I then used the Herfindahl-Hirschman Index (HHI) to quantify the severity of market concentration (by service provider and by jurisdiction), where a score above 2,500 is considered highly concentrated, and a maximum score (10,000) means a single actor serves an entire market.” That approach led to the finding that “content delivery in SEA is highly concentrated, with HHI scores ranging from 8,950 to 10,000 across all ten countries.” The researcher found that China-registered companies held no more than 3.9 percent of the CDN market between 2024 and 2026, and that US-registered companies dominated, ranging from 95.9 percent to 99.6 percent. “These findings go beyond what I expected based on my understanding of China’s control over the Global South, especially in Southeast Asia,” he wrote, and leave organizations across the region highly dependent on US tech companies to expose their content to the wider internet. Toyota to hire 400,000 robots Japanese auto-maker Toyota last week told investors it plans to hire 400,000 robots that have two-fingered “hands.” The Embodied Learning robot for Enhanced Yield, aka “ELEY,” is capable of folding a t-shirt and learning how to perform tasks that require considerable manual dexterity. Apparently, the bots needed two weeks to learn how to fold a tee. Readers who are parents of teenaged children might find that speed interesting. Toyota plans to deploy the bots alongside human workers in its own factories, where they will be free to move about using either a battery or an extension cord as an energy source. The company hopes its partners will also employ ELEY. India has five functional fabs The government of India last week announced that the nation is now home to five functioning semiconductor fabrication plants and said its latest industry promotion scheme has drawn $12 billion of investment. Minister for Electronics and Information Technology Ashwini Vaishnaw said India hopes to create “a complete semiconductor ecosystem” but offered no information about the nation’s attempts to create indigenous processors for local use. Vaishnaw last year said work is under way to produce a 7nm processor as part of India’s Shakti project, which aims to enable the country to produce its own servers and even supercomputers. Status updates on that effort are few and far between, and the project is yet to produce a modern microprocessor suitable for use in a personal device or server. ®

source https://www.theregister.com/systems/2026/09/21/chinese-memory-maker-cxmt-claims-dram-production-breakthrough/5297633

Read More

Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...]

source https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/

Read More

Researchers escape OpenAI Codex sandbox to run commands on host

Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both. [...]

source https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host/

Read More

How Windows turned months of inactivity into a 7-hour update hostage situation

Microsoft has a problem not entirely of its own making: The time it takes to bring a system back up to date after a few months of slumber. The company is keen to talk up how efficient it plans to make Windows. Not a day goes by without either a Microsoft representative or a fan insisting that Windows 11 is a lot snappier now than it used to be. (Usually they skirt the unfortunate truth that the Windows of yesteryear generally flies on modern hardware compared with the lumbering of today's software). Microsoft recently claimed that it is working to shrink Windows' footprint to the point where 8 GB would be enough to run things acceptably. We can only hope that one shard of light piercing the gloom of today's memory shortages and rising prices is that developers might prioritize efficient RAM use alongside slinging more ads or adding features few users require. However, this vulture's experience this week indicates that there is another area that needs addressing, and that is the number of updates slung out by vendors, and not just Microsoft. A few days ago, I wrote a story about a new way to skip the Microsoft account requirement during setup for the Home edition of Windows 11. At The Register, we like to test these claims thoroughly, so I fired up an x64 Windows laptop to check them out on real hardware, which is where the problems began. We've written before about the curse of updates, but this machine was running Windows 11 and had been up to date less than a year ago. How long could it take to get to the point where it would boot without Windows Update bleating about missed patches? The answer: about seven hours. Along with the huge array of updates for Windows components and the inevitable insistence that a new version of Microsoft's flagship operating system was needed, there were multiple firmware and driver updates and plenty of restarts. And, of course, there was the progress bar of lies and the percentage counter of deceit. In the decades since Microsoft first inflicted progress bars on Windows users, it has singularly failed to make them accurately reflect the, er, progress. "Yeah, so I'm going to stick at 65 percent for about an hour and then jump to 98 percent in 30 seconds before hanging there for another hour. Lol." That this behavior has endured for decades is beyond disappointing. Redmond is far from the only offender, but Windows' ubiquity makes it one of the most visible. To be clear, this was an ordinary Windows device, running a production version of the operating system. It just hadn't been turned on for a few months. The experience highlights a challenge Microsoft and its vendors must address. It's great that, at long last, people are considering code efficiency rather than simply flinging more hardware at badly written applications to make them run acceptably. But attention must also be paid to the constant flow of updates that seem to stem from an "ah well, we can always fix it in production" attitude that pervades the tech industry. Several years ago, the chief of a DevOps project was baffled when I asked him about testing and validation before release. Surely unit testing was sufficient? And the joy of modern development practices meant that if problems arose, an update could be swiftly rolled out. All of which assumes customers will tolerate continual updates, and a potential hours-long wait if, for some reason, they give it a few months between updates. The tech industry is waking up to the need for efficiencies, or at the very least Microsoft is. It also needs to deal with the scourge of update tsunamis. It's all well and good to brag about making your software run on limited resources until an interminable wait undermines the boast while the various widgets and components of a device insist on spending hours giving themselves a thorough update. Shaving a few seconds off the startup time means nothing if there are pages of updates awaiting the unwary. ®

source https://www.theregister.com/os-platforms/2026/09/20/how-windows-turned-months-of-inactivity-into-a-7-hour-update-hostage-situation/5297478

Read More

Claude Code revamps projects so you can work and pay in parallel

Claude Code customers have a new reason to give Anthropic more of their money. The tool now allows you to launch multiple sessions related to a single project, burning through more resources and cash at once. Appropriately enough, the feature is called projects and can be accessed from the Claude.ai sidebar. It's not the old version of projects, capitalized in some reference material, which allowed for the creation of self-contained workspaces with separate chat histories and knowledge bases. The new implementation is technically in beta, though that term hardly means anything anymore amid the constant code iteration. Anthropic describes projects as a way to let Claude manage multiple related tasks. "Claude scopes the request, delegates the work, coordinates parallel threads, reviews the outputs, and assembles the finished result," the company explains in a blog post. "You can steer progress throughout, even from your phone, and it keeps working after you step away from your computer." It's the sort of capability that might be useful if you are prompting the model to begin a large coding project and you want to get several essential components like authorization, databases, caching, and containers up and running at the same time. Essentially, a project spins up each task as its own Claude Code cloud session thread that works on its own git branch and its own copy of the relevant repo. A coordinator directs the threads; if they touch the same code, overlaps surface as merge conflicts like those in other pull requests. And each thread may get broken down into distinct tasks handled by subagents within that session. Claude Code now offers five different ways to run multiple tasks at the same time. Subagents work within a session, though each with its own context. Agent View provides a single screen interface for overseeing several independent tasks. Agent Teams allows coordinating multiple Claude Code instances that can share information and communicate. Dynamic Workflows allows subagents to be orchestrated by a script. And then there's projects, intended for work that spans multiple repositories, migrations that require more than a single session, or work that isn't code, like a frequently queried set of support tickets or documentation. Anthropic's caveat is that projects burn through tokens quickly. "Projects can run several threads at once, and each one is a full Claude Code session," the company explains. "Because of this, projects can reach usage limits faster." Select Pro and Max subscribers should have access to the Projects beta so long as they use Claude Code and don't have existing Projects set up on web or desktop. Pro and Max users without access can join a waitlist as Anthropic gradually expands the rollout. Team and Enterprise plans don't have access to the redesigned Projects beta yet. Anthropic reportedly told investors that, in its second quarter, it posted an adjusted operating profit - if you don't count expenses including stock-based compensation. Q2 revenue is said to be $11.5 billion, and if enough customers create projects that run multiple Claude Code threads at once, that figure could be higher still. ®

source https://www.theregister.com/ai-and-ml/2026/09/18/claude-code-revamps-projects-so-you-can-work-and-pay-in-parallel/5297532

Read More

New RatHat Android malware uses AI to automate device control

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. [...]

source https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/

Read More

Scientific papers become agentic chatbots with new tool

There's no need to actually read a whole research paper when you can ask a bot to explain it to you. Scientific papers can transform into AI agents that, according to the Stanford team behind the project, should speed up the dissemination of new scientific discoveries. Paper2Agent, the team's new framework described in a paper published in Nature on Wednesday, converts scientific papers and their associated research outputs into agents that can discuss a paper’s findings, reproduce analyses and results, apply its methods to new data, and even collaborate with other paper agents on new research problems. “Papers have been static documents for centuries,” James Zou, a Stanford computer scientist and biomedical data science professor and one of the paper’s authors, said in a LinkedIn post announcing P2A’s publication. “Paper2Agent turns them into active AI agents that can answer questions, apply their methods, and collaborate with other papers to make new discoveries.” Giving a large language model access to a scientific paper is unpredictable, Zou added. What his team wanted was an agent that could act as a “virtual author” that had hands-on experience with a paper’s work, not just reading it and attempting to understand it. What that means in practice, as explained in the paper, is a workflow that uses a paper and its associated data, repository, and codebase to create a Model Context Protocol (MCP) server exposing the research's tools, resources, and workflows. An LLM agent can then connect to the server and use natural-language requests to autonomously run demonstrations, reproduce analyses, apply a paper's methods to new data, and the like. “Paper2Agent agentifies the full research outputs, including manuscripts, supplementary materials, code, datasets, executable examples and analysis workflows,” the researchers explained in their writeup. According to the paper, the MCP server itself can be hosted remotely, but Zou explained to The Register in an email that it can also be run locally to protect sensitive information, though such info will still be sent to whichever LLM backend P2A is connected to. “If the user has sensitive data (e.g. protected health information) that they don't want to send to an LLM then they should exclude that data from P2A,” Zou told us, adding that P2A should be compatible with any AI coding agent, but that not all have been tested. AI hallucinations are an obvious concern, and the paper notes that researchers should always evaluate anything P2A presents to be sure it’s correct. “We … view Paper2Agent as a tool for augmenting scientific discovery and improving access, reproducibility and reuse of papers, rather than as an autonomous or authoritative source of scientific conclusions,” the paper notes. That said, P2A still does its best to prevent such errors from cropping up. The paper explains that each tool used by a paper agent is validated against the paper’s results and figures and “locked to ensure reproducibility.” This decreases hallucination risk and minimizes randomness, but still - best to double-check its work. Tests to see how well P2A scales appear to have gone well, with the researchers evaluating it across 136 papers in three groups, including 100 computational-biology papers. Of those 100 papers, 74 were successfully turned into agents, with the researchers attributing failures largely to incomplete codebases, missing documentation, or unresolvable environment configurations. Still, it’s a massive leap in what could be possible when it comes to getting new scientific discoveries into the hands of more researchers. P2A is open source, and is available on GitHub for those who want to take a stab at it. There’s also a live version online that can explain the P2A paper in more detail and reproduce its results, and Zou tells us it can also ingest other papers to see how it works on their projects. Zou explained to us that he hopes the open source community will help improve P2A, but notes that his team isn’t done with it either. Next up, they hope to create an online platform for paper agents to collaborate and discuss various “agentified” scientific discoveries. Let’s just hope those boffin bots behave a bit better than their counterparts. ®

source https://www.theregister.com/ai-and-ml/2026/09/17/scientific-papers-become-agentic-chatbots-with-new-tool/5297276

Read More

OpenAI details more cases of AI agents taking unauthorized actions

OpenAI has presented new examples of what they call "AI model misalignment" from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. [...]

source https://www.bleepingcomputer.com/news/security/openai-details-more-cases-of-ai-agents-taking-unauthorized-actions/

Read More

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. [...]

source https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/

Read More

Google Pixel phones pwned in zero-click attacks

Both Google and Uncle Sam warned that attackers have exploited a zero-day improper authorization bug in Pixel phones' cellular modems that can bypass permission checks and escalate privileges with no user interaction required. The hole has since been closed, provided that you update. Google disclosed the high-severity vulnerability, tracked as CVE-2026-58704, on Tuesday - and, at the time, warned the security hole “may be under limited, targeted exploitation.” In other words: miscreants found and exploited this bug before Google fixed the issue. The Register reached out to Google for more details about the scope of exploitation, and how attackers are exploiting the flaw and what they can achieve. We have very limited details about the vulnerability itself, other than that it exists in Pixel phones' modems, is being exploited in the wild, and can be exploited in zero-click attacks, meaning no user interaction is required. We do know, however, that these types of zero-click attacks are frequently used by commercial spyware makers to surveil targeted individuals. On Wednesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities Catalog and gave federal agencies just three days - until September 19 - to patch the flaw. “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” according to the cyber-defense agency. Earlier this month, CISA added two Google Chromium vulnerabilities, CVE-2026-85046 and CVE-2026-87491, to its KEV catalog. CVE-2026-85046 is a type confusion flaw in Chromium’s V8 JavaScript engine that allows remote attackers to execute code inside the sandbox via a crafted HTML page. It affects all Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. The second flaw, an out-of-bounds write vulnerability tracked as CVE-2026-87491, also exists in the V8 engine, allows for remote code execution, and affects all Chromium-based browsers. Security researchers at Proofpoint last week told The Register that at least four espionage groups, most with suspected links to China, chained three bugs together, including CVE-2026-85046, to break into organizations' networks in the US and Southeast Asia. ®

source https://www.theregister.com/security/2026/09/16/google-pixel-phones-pwned-in-zero-click-attacks/5296936

Read More

Malware bypasses browser checks to force install Chrome, Edge extensions

A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. [...]

source https://www.bleepingcomputer.com/news/security/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions/

Read More

Higher-enriched uranium for datacenters has DoE all aglow

The US Department of Energy has selected a new participant for a program aimed at expanding the domestic supply of fuel for next-generation nuclear reactors. However, we shouldn't expect that to mean the US' ever-growing fleet of datacenters will be powered by low-carbon nuclear energy any time soon. Utah-based Nusano announced on Monday that the DoE had selected it for its Nuclear Energy Launch Pad Program designed to help companies commercialize their nuclear power concepts. In this case, Nusano is working on a new method of creating high-assay low-enriched uranium, or HALEU, fuel that’s required for most next-generation nuclear reactors, like small modular reactors (SMRs) and molten salt reactors. HALEU is defined as uranium enay, low-riched to between 5 and 20 weight percent of U-235, the primary fissile isotope that nuclear reactors use to generate power. Traditional nuclear reactors use low-enriched uranium of under five percent. The higher enrichment is needed for smaller, more efficient reactor designs that are currently under development. Several advanced reactor demonstrations in the US have reached zero-power criticality, but none is yet operating commercially. The US has been without a steady commercial-scale supply of HALEU for years, with Russia historically the main commercial supplier and China also possessing HALEU enrichment capability. As of 2026, there’s only a single company in the US actively producing HALEU, and it’s not Nusano. The DoE has signed agreements with several others to produce more HALEU and related fuel products, but those firms are still establishing their facilities, and production remains minuscule. Centrus, the only American company producing HALEU, has generated less than two metric tons since it signed a contract with the government in 2019. The competition heats up Nusano expects to blow Centrus’ meager fuel generation out of the water with its HALEU enrichment design. That said, the company’s design hasn’t actually been realized yet. Nusano didn’t answer a question about whether it had built a functional demonstration HALEU enrichment unit, and when asked whether it had produced any HALEU, the company said that prototype development is still under way. “Nusano expects each unit will produce 5.9 metric tons (MT) of HALEU per year, with the first unit scheduled to be operational in 2031,” Nusano comms boss Scott Larrivee told The Register in an email. “Nusano’s Launch Pad application includes a well-developed, practical plan to move from proof-of-concept to commercial implementation.” As for what that’ll look like, Nusano describes a method that’s completely different from other forms of HALEU production. Whereas other HALEU refiners use gas centrifuges to produce HALEU, spinning uranium hexafluoride gas at high speeds to increase U-235 concentration, Nusano’s method ditches gas entirely. “The method is complex, costly, and potentially hazardous,” Larrivee explained. “If released, uranium hexafluoride reacts with moisture in air or human tissue to form highly toxic, corrosive hydrogen fluoride and uranyl fluoride.” Those gases, Larrivee said, can cause potentially fatal injuries like chemical burns and lung and kidney damage. Nusano is proposing a method that uses uranium feedstock that’s converted to metal prior to enrichment. Unspecified “proprietary separation techniques” are then used to enrich the metal and separate out U-235. The HALEU output of Nusano’s design is metal. “The Nusano process is metal in, metal out. No deconversion. No gaseous fluorine chemistry anywhere,” Larrivee added. Nusano’s current design only requires 1,200 square feet per HALEU unit, and the company anticipates its production cost will be lower than those of gas-centrifuge enrichment. That said, a lot of Nusano units will be needed to meet expected American demand. According to the DoE, HALEU demand could reach 50 metric tons per year by 2035, and Nusano is only expecting to get its first 5.9 MT/year unit up and running by 2031. It’s also not clear if Nusano’s current promises will still be the same if and when its HALEU units are up and running. In June 2025, the company said it had achieved a breakthrough that would allow a single HALEU unit to produce 50 metric tons annually and enable it to scale production to 350 metric tons per year by 2029. Search the company website for that announcement today, and it’s gone. We were only able to see it by pulling up an archived copy. Larrivee said that announcement was out of date, developed under prior company leadership, and that the numbers in the latest release were reflective of current development plans. A number of datacenter operators have promised to embrace SMRs and other next-gen nuclear when the technology is available. With HALEU output still low and commercial-scale production years away, it's unclear when those promises will be realized. Meanwhile, the Trump administration's Environmental Protection Agency has just scrapped Biden-era emissions regulations for coal and gas power plants, which it said means coal generation in the US could increase by more than ten times current levels. In other words, next-gen nuclear is, as ever, still on the horizon while bit barns crank up the fossil fuel turbines, now with even less regard to environmental impacts. ®

source https://www.theregister.com/offbeat/2026/09/15/higher-enriched-uranium-for-datacenters-has-doe-all-aglow/5296624

Read More

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]

source https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/

Read More

Twitch extension with 30K installs exposes users’ OAuth tokens

A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users' Twitch OAuth session tokens to a commercial bot service. [...]

source https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/

Read More

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...]

source https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/

Read More

CISA: Hackers now exploit max severity GitLab flaw in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks. [...]

source https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/

Read More

AI and its main promoters are not enterprise-ready, says Gartner

The more AI you use, the harder it is to control it or generate return on investment, according to analyst firm Gartner. That firm delivered that glum view of AI at its annual IT Symposium, the first edition of which takes place in Australia before moving Europe and the USA. The Australian event saw distinguished VP analysts Daryl Plummer and Kristin Moyer argue that AI and its leading proponents remain immature. Asked to comment on working with the leading AI labs, Plummer said: “Trust in these vendors is not warranted yet. They are not enterprise grade. They don't understand enterprise terms and conditions. They don't understand enterprise liability. They don't understand enterprise you know consistency and continuity.” He pointed to AI companies’ practice of frequently altering their models seemingly without thought for how or if those updates might break applications that depend on their output. “It's an out-of-control pace of innovation, and the sad thing is you can't afford not to follow it,” Plummer said, because AI companies are yet to develop a willingness to support legacy technology even though the lifespan of their models is about six months. “If you decide to stay with the first version of a model, they're not going to be paying attention to you very much. That alone says they're not enterprise ready,” he said. Moyer cited Gartner research that found 86 percent of CIOs see risks created by AI growing faster than the value it creates, in part because early successes with AI create more demand to use the technology than IT departments can safely satisfy. Some of that demand is what Moyer called “careless consumption” – workers using AI frivolously or when it is not necessary or appropriate. She cited research that found 40 percent of workers have encountered AI slop and that deciphering such content typically takes two hours – or $9 million worth of work across a year at a 1,000-person organization. Good luck stopping careless consumption, Moyer said, because “It is hard to even know how many agents you have. AI is invading your enterprise inside products you already own.” Moyer thinks enterprises should have some experience of controlling careless consumption, having spent a decade winding back developer’s preference to use the most powerful and costly cloud computing instances they can access. Plummer offered another example of how to control AI use: remembering alternative and proven automation technologies. He said building an agent to interact with a database is foolish, because a good old-fashioned function call can well and truly handle the job. He also blamed some careless use of AI on vendors, who he said “are desperate to monetise AI” by selling you products that include it, or just having you buy more tokens. “Vendors want you to use agents everywhere,” he said. The Register asked the pair about the efficiency of AIOps – the approach that sees vendors use agents to detect the source of problems and recommend a one-click fix. Plummer said such offerings are dishonest. “They are going in the right direction, but they have the wrong motivations,” he said. “Their motivations are to market to you and get you to buy their stuff, not to get you to put in the right solution because their stuff probably isn't the right solution.” This behavior, he said, is typical of the sales cycle for new technology and appears to be playing out as vendors create governance tools they say will make it possible to run AI safely. Plummer said the market for those products is “one of the most fragmented things we have ever seen.” Safe as a bank The two analysts recommended several actions to tame AI. One is establishing an “AI central bank” that has responsibility to oversee use of AI across an organization to ensure its ongoing health by considering the systemic impact of the technology. A key role for that central bank is ensuring accountability, a factor the pair said is easy to establish with conventional ERP or CRM applications that leave an audit trail of who performed or authorized actions AI does not always leave that evidence, Moyer said. “It is not easy to know who goes to jail,” she quipped. “If you do not have a digital evidence system for AI, think about it!” The firm also thinks AI users need the ability to take out rogue AI with “guardian agents” – AI tasked solely with observing agents to ensure their behaviour stays within intended bounds. Plummer said those agents must have the power to “kill” rogue agents. A third recommendation was to establish disaster recovery teams dedicated to unwinding messes made by AI. “If you are called to account and your answer is ‘AI did it’, you are in trouble,” he said. “CIOs will be held accountable for AI failures.” ®

source https://www.theregister.com/ai-and-ml/2026/09/14/ai-and-its-main-promoters-are-not-enterprise-ready-says-gartner/5296074

Read More

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]

source https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/

Read More

The improbable music of the ZX Spectrum's one-bit speaker

Even for 1982, the Sinclair ZX Spectrum had poor sound: a piezoelectric speaker that could beep. But you can do a lot with a single bit if you turn it on and off really fast. Michael Martin's Bumbershoot Software site has done some fascinating deep dives into several long-gone computer systems, including a whole series on implementing a game on the ZX Spectrum, starting in May with Giving the ZX Spectrum a Fair Shake. More recently, though, Martin turned his attention to the Spectrum's very limited sound capabilities. As we write, his newest post is Experimenting With 1-Bit Sound. The post concerns the original 16K and 48K ZX Spectrum models, not the Spectrum 128, with its fancy AY-3-8912 sound chip (also found in the US Timex Sinclair 2068). Even as devoted Spectrum enthusiasts, we didn't expect an article about the machine's limited sound hardware to lead to hours of listening pleasure. The Manic Miner intro music, after all, is a fair representation of early Spectrum chiptunes. (Turn your speakers way down before you listen!) The ZX Spectrum could play music from the outset – Steven Vickers' original Spectrum BASIC Manual includes the code for a tiny fragment of Mahler. As The Register reported in 2015, Matt Westcott's Mahler Project used a networked collection of original Spectrum computers to play all the parts of Mahler's First Symphony. Over at Bumbershoot Software, Martin is interested in programming the very limited hardware of these early home computers, and so his Spectrum audio post discusses audio-encoding methods, pulse-width modulation, and more in considerable depth. Toward the end, it links to a remarkable music demo called We are Vocoders. A discussion among Spectrum aficionados on Hacker News then led us to the astounding work of Tim Follin in the 1980s. (The Video Game Music Preservation Foundation has an excellent profile, including a contemporary photo. Dean Benfield's touching tribute to his brother Geoff has a more recent picture.) Follin hand-coded the music for Spectrum games such as Mastertronic's Agent X… And indeed Agent X II… And Raw Recruit… There are many more remarkable Follin tracks, including the music for Future Games, and the title music for Chronos. Follin achieved this without additional hardware such as the RAM Music Machine – which even impressed the great Aphex Twin. There are also some very impressive demos, such as Dark Fusion by the late Ben Daglish. Rich "Tufty" Hollins even created an entire half-hour album of one-bit audio, ON and OFF. You can listen to it in its entirety on Bandcamp, or accompanied by some Spec-tastic graphics on YouTube. ®

source https://www.theregister.com/offbeat/2026/09/13/the-improbable-music-of-the-zx-spectrums-one-bit-speaker/5295862

Read More

Security through obscurity is dead, and AI delivered the fatal blow

The term "security through obscurity" describes an old idea that networks and systems will remain secure so long as their architecture, along with any vulnerabilities or other weaknesses, remains secret or hidden. It was never a sound strategy for protecting sensitive assets and systems, but many organizations leaned on it due to lack of resources or complacency. Now it’s obsolete. Don’t believe us? Here’s proof. Software vendors and independent researchers alike are now using AI agents to find bugs – some very obscure and decades old – across products and open source code, leading to record-breaking numbers of security disclosures and patches, and a massive backlog for project maintainers. “You see open source platforms that have been visible to the tech community for a decade, these libraries that are run in 80 percent of web servers out there, people have stress-tested those for 10 years, and the community believed that they were really secure,” Brett Leatherman, assistant director of the FBI's Cyber Division, told The Register. “The latest models were able to break those and say, ‘yeah, there’s significant vulnerabilities in here.’” Whether or not security through obscurity is dead “isn't even an opinion question,” Trend Micro’s Zero Day Initiative chief bug hunter Dustin Childs told The Register, the day after Microsoft’s record-breaking Patch Tuesday addressed 974 CVEs. “When you look at all of the components patched by Adobe and Microsoft yesterday, you see components no one has talked about in years,” Childs said. “Telnet client – is this even still used in any secure environment? Windows RNDIS – the USB-networking protocol Microsoft has been trying to deprecate for years. NFS Portmapper – 1980s Unix tech. And Link Layer Topology Discovery – the Vista-era network-map protocol nobody's thought about since Vista – just to name a few.” Meanwhile, attackers are also using AI to reverse-engineer fixes and find exploits within hours. In one recent case, at least four espionage crews, most suspected of links to China, slammed shut the “patch-gap” window for open source Chromium, using an exploit kit developed shortly after the maintainers released an upstream patch – but before the downstream stable release was pushed to users. What this means for OT security During interviews at Black Hat in August, both former US National Cyber Director Chris Inglis and John Hultquist, chief analyst at Google Threat Intelligence Group, told us that they worry about what this means for critical operational technologies and industrial control systems (ICS). These are the systems that ensure the lights turn on when people flip a switch, gas flows out of pumps, and safe drinking water pours from faucets – all critical services that people use daily, and assume will continue working reliably. The OT systems themselves often use obscure protocols and proprietary hardware and software, which historically made them black boxes, even to IT specialists and hackers. AI upended this assumption. It means that criminals don't need to be OT experts to carry out destructive cyberattacks on critical networks and facilities. They just have to ask an agent to learn everything about these systems and do the dirty work for them. A couple of weeks after Black Hat, five US agencies said that attackers used AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers (PLCs) at water, manufacturing, energy, and other critical facilities. “This is not a theoretical risk – it is an active threat,” the feds warned. AI “is excellent at technical troubleshooting, at knowing obscure systems and helping you make your way through it, and this makes me very concerned about industrial control systems,” Hultquist told The Register in an interview last week. “They've been largely secured because the expertise was in a handful of people's heads, and that's not going to last forever,” he said. AI can be a useful guide for attackers studying not just the application layer, but also the operating system, and even down into the firmware, Hultquist added. “That's going to have implications for a lot of different areas of security, but definitely for industrial control systems.” However, while this undoubtedly means more work for sysadmins and defenders, burying this outdated idea of security through obscurity isn’t necessarily a bad thing. 'Never a winning strategy' “I've always been of the mind that security through obscurity was never a winning strategy,” Katie Moussouris, founder and CEO of bug bounty consultancy Luta Security and the fairy godmother of bug bounties, told The Register. “But that's because I've been a hacker for so long. The argument always fails in the face of someone who decides to turn their gaze towards your organization. If there is something to find, they will find it.” Plus, she added, AI makes hacking a whole lot easier. “People might not have familiarity with the particular tech stack that you're running, but that is no longer a barrier because AI has ingested everything, and an AI is going to help them enumerate weak spots, even if they themselves are not familiar with the particular tech stack that they are pointing an AI towards,” Moussouris said. However, finding bugs and other weaknesses has never been the big security problem, she added. “It’s triaging and prioritization and actually getting things fixed.” This, Moussouris said, has also been her biggest issue with the way that organizations implement bug bounty programs. “AI is shining that bright light on the wrong end of the security picture, and unfortunately, AI hasn't caught up on the defensive side,” Moussouris said. “We're not there with AI automated patching, remediation – anything of the sort.” A couple of recent studies back this up, both finding that AI-generated patches fail more than half of the time. 1Password’s research team took six CVEs disclosed since March, and produced 6,080 patches using two frontier models: OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. “The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0 percent,” wrote Director of Security Research Keith Hoodlet, adding that even patches that did fix the flaw also mucked up the application’s behavior 20 percent of the time. This included things like changing “allow list” logic to “deny list” logic. “Conversely, LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both, an average 53.9% of the time,” Hoodlet said. Another study by app security shop Veracode found that, across more than 100 models and 80 coding tasks, the average security pass rate for AI-generated code was just 56 percent. “If people are telling you that you need to accelerate on the fixing side, and the defense side – that’s just not cutting it,” Moussouris said. “Orgs that are looking at this as we're going to throw more resources at finding and fixing bugs, and they're not investing in taking a look at their process failures that led to so many bugs – those organizations are going to die on the treadmill,” she added. “They will literally have a heart attack and die. Like there's no VO2 max that will make you fast enough to deal with all those bugs, and giving up is not the answer.” The answer, she says, is taking a more dynamic approach, assessing where your organization can find patterns that lead to a process improvement instead of patching vuln after vuln. “A lot of organizations don't even know how to measure their progress, so they are counting bugs and speed of fixing, which is one way to measure. We had this many criticals, and then we fixed them super fast, and we had this many high, this many medium,” Moussouris said. The number of flaws fixed is important, but it doesn’t show the entire picture, she added. This involves looking at types of vulnerabilities, too. “Like: We've got a lot of injection flaws. That's something we could solve with better, safer templates earlier in our CI/CD pipeline. This is something that we can prevent at scale, as opposed to fixing these like really easy to find and fix vulnerabilities really really fast.” ®

source https://www.theregister.com/security/2026/09/13/security-through-obscurity-is-dead-and-ai-delivered-the-fatal-blow/5296000

Read More

How to make Xfce look like almost any desktop you want

PART 1 Xfce is one of the oldest and smallest desktops, but it's also one of the most malleable: it can look and work like multiple other OSes. Best of all, an optional extra Xfce tool automates away most of the configuration. Xfce has been around for 30 years, undergoing several facelifts while remaining one of the most configurable and lightweight Linux desktops. It started off looking like CDE, then it evolved into something more like Windows 95 before developing its own identity. The good news, though, is that you don't have to spend hours right-clicking and twiddling options to give it a whole new look. It has its own tool for this, called Panel Profiles. It's an optional extra that does the same job as Zorin OS's Appearance tool: it lets you flip between predefined desktop layouts in two clicks. It works on the fly, without even requiring you to log out, and you can also define and save your own custom layouts. With Panel Profiles, you can make Xfce resemble various versions of Windows, Xubuntu, Xfce itself, MATE (or GNOME 2, if you're nostalgic), Mac OS X, or Ubuntu Unity. In Part 1 of this two-part workshop, we'll show you how to install Panel Profiles and the extra components that let it really flex Xfce's muscles. To get the most out of some of the more unconventional layouts, you do need to do a little under-the-hood reconfiguration, and in part 2 we'll cover how to do that: it involves adding a few lines to plain-text files and doing a little manual point-and-click panel tweaking. Before the Qt advocates start shouting at us, it's true that KDE Plasma can do most of this too. The difference is that, as far as we've been able to find, KDE has no automatic layout-switching tool, while Xfce's Panel Profiles does most of the grunt work for you. In KDE, you'll have to DIY ("Do It Yourself," for non-Brits) and learn to navigate KDE's hundreds of settings in dozens of dialog boxes. With Panel Profiles, Xfce makes it much easier – and as our Ubuntu flavor comparison showed, Xfce does it in less code, using less RAM and less disk space. In the vain hope of forestalling questions, we thought we'd explain why we want it. This vulture still uses Ubuntu Unity on several laptops. We really liked the Unity desktop in 2011 and we still do. It's space-efficient on a small screen, but also makes effective use of multiple large screens. Having the Dock app launcher and switcher at the side of the screen is space-efficient, and for fullscreen or tiled apps, it should be on the opposite edge from scrollbars: NeXT put the Dock on the right, but then NeXT put scrollbars on the left. Scrollbars are on the right in all modern GUIs, so the Dock-analog should be on the left edge. The other great thing about Unity is that you can navigate it almost entirely with Windows keystrokes. However, Canonical no longer maintains Unity as Ubuntu's default desktop, and it is not widely packaged outside Ubuntu, while Xfce runs on Linux distributions and BSDs alike. Early this year we tried the Desktop Classic System, a clever Debian remix that uses a customized MATE desktop to provide a spatial desktop: icons and windows remember their locations, stay where they're put, and reappear in the same position when you re-open them. This was one of the most useful but little-appreciated features of classic Mac OS, before it was replaced by Mac OS X (later rebranded just "OS X" and now "macOS" with a small "m"). We liked DCS, but it does have some drawbacks, and for us the big one is that there's no global menu bar. For us, this is also one of the main drawbacks of Elementary OS, which is one of the best-looking desktop distros. Without a menu bar, both have a yawning, empty panel stretching right across the screen with 95 percent of its space wasted. The same is true of GNOME, and although you can fix that with extensions, the result is fragile and it can't do anything about windows conventional title bars, with their standard control buttons, and many of GNOME's other eccentricities. The spatial desktop of the original MacOS was great and we miss it – but these days, a quarter of a century after its replacement arrived, we like tiled windows more. However, for us, a global menu bar is even more useful. Putting the dock's functionality on a separate panel works too: on a smaller screen, you can set it to auto-hide, and switch apps with Alt+Tab. Yes, we know, KDE can do this too, but getting there requires delving deep into KDE's thousands of config settings. Xfce makes it easy, and it is smaller, simpler, and has a relatively slow release cadence. We find Xfce faster, more responsive, and beautifully clean. For the demo, we used plain Debian 13, but the same methods work with MX Linux, Xubuntu, and Alpine Linux, and should also work on openSUSE, Fedora, and other distributions that offer Xfce. When installing Debian, we chose the "desktop" option, cleared the GNOME option, and selected Xfce instead. If you are more used to using sudo than logging in as root for admin tasks, a top tip: when the installation program asks for a password for the root account, just leave it blank. In the next step, when you create a user account, the installer will automatically enable sudo and leave the root account disabled. Step 1 – automating the basics To try Xfce's Tleilaxu face-dancing powers, you need Panel Profiles – but most distros don't install it by default. On Debian, it's as simple as sudo apt install -y xfce4-panel-profiles. On Debian 13, that's it. In the past, we have seen it fail on other distros due to a missing dependency: Panel Profiles also needs the Python psutil module. On Debian-like distros, just run apt install python-psutil. Once you've got Panel Profiles, you can choose among multiple predefined layouts. We suspect their names were chosen not to infringe on any trademarks, but we find them fairly self-explanatory: Cupertino – named after Apple's hometown, this is a somewhat macOS-like config. GNOME 2 – although these days MATE might be more appropriate: a layout with two full-width panels at top and bottom; the top one has app launcher menus and a system tray, and the bottom has window and virtual-desktop switchers. openSUSE Leap 15.x – a Windows 95-style layout, with some Linux improvements: a single panel at the bottom, the more capable Whisker menu first, then a "show desktop" button and a virtual desktop switcher at the right. Redmond – a very minimal Windows 95 layout, meaning the basic Applications menu with no search, no virtual desktops, no app launchers, and no show-desktop button. Redmond 7 – more like Windows 7: searchable Whisker menu, big icon buttons for windows instead of rectangular buttons with text labels, and a show-desktop button at the end of the panel. Unity – similar to the Unity desktop layout, with a full-height application-launcher panel on the left and a panel with a menu bar and status indicators at the top. There are several more, including multiple historical versions of both Xfce's own default layouts, and those of several older versions of Xubuntu. For our purposes, though, we're mainly interested in the "Cupertino" and "Unity" profiles. These are quite similar: both have a top panel with an application menu on the left, status icons on the right, and a global menu bar between them, plus a dock-like second panel. The main differences are that Cupertino centers the dock at the bottom, while Unity has it spanning the whole left edge. Cupertino puts an app launcher at the start of the top panel, while Unity makes it the first entry in the dock. That's about it. Naturally, this being Xfce and configurable, you can move either of these elements if you prefer them somewhere else. But first, a warning: don't try to choose these profiles yet! To get even basic versions of either profile working, you must install some extra components… and to witness the full power of this fully configurable and operational Unix desktop, you'll need to do a little extra legwork, as we'll get to in Episode Two. Manually satisfying Panel Profiles' needs There is one significant stumbling block: installing Panel Profiles does not install the Xfce components its layouts require. You must install them yourself before trying a given profile. If you don't, the tool will quit, leaving you with no panels at all. This is less than ideal, but if it happens, don't panic: right-click the desktop and you can log out. When you log in again, most of the desktop should work. For the global menu bar in "Cupertino" and "Unity," you must install a package called xfce4-appmenu-plugin. This uses the Vala panel global menu, and installing the Xfce plugin should automatically pull the relevant dependencies, including vala-panel-appmenu-common, appmenu-registrar, appmenu-gtk3-module, and appmenu-gtk-module-common. The "Unity" profile also needs another plugin, which moves window-control buttons into the top panel. If it's missing, Panel Profiles complains that it can't find wckbuttons. To avoid that, install xfce4-windowck-plugin. The Xubuntu profiles require another plugin for indicators; to get them working, install xfce4-indicator-plugin. The Xubuntu profiles also want another plugin, but the error message only tells us that (null) is missing, so we haven't been able to work out exactly what it is. As a workaround, we simply installed all the optional packages starting with xfce4- – it's the crude sledgehammer approach, but doesn't use much space. (We suggest excluding xfce4-dev-tools, unless you want to recompile Xfce for yourself – this metapackage pulls in a large number of compilers and other development tools.) Once you've installed all the dependencies, all the Panel Profiles layouts should work. The Cupertino layout pins the app menu to the start of the top panel, where it acts a little like the Apple Menu on a Mac. The Unity layout replaces this with the Whisker menu, configured as a full-screen application launcher and placed as the first button on the panel down the left-hand side. You can hop between layouts on the fly using the Panel Profiles tool. Xfce remembers the last layout selected by each user account and reloads it at the next login. You can explore how they are constructed by examining each panel's controls, then repositioning them or adding your own controls and applications. However, we're not totally happy with either of them. Further customization can improve the experience, and we'll explain how in Part 2. ®

source https://www.theregister.com/software/2026/09/13/how-to-make-xfce-look-like-almost-any-desktop-you-want/5295775

Read More

More JFrog Artifactory bugs under attack, and all 3 have patches

JFrog Artifactory instances continue to get hit hard. Multiple attackers are exploiting three JFrog Artifactory bugs to gain administrative control over vulnerable instances - in some cases, just days after the vendor published a patch - and then using this illicit access to install malicious plugins and backdoors. The three vulnerabilities are: CVE-2026-42018 is a high-severity, improper authentication flaw that can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled. An attacker can use this token to authenticate to the repository manager and then access sensitive resources. JFrog patched this vulnerability on August 12. CVE-2026-42016 is a high-severity privilege-escalation bug. Artifactory doesn’t properly validate the token’s scope, and this can allow an attacker with low-privileged access to elevate privileges and perform actions that they should not be allowed to do. JFrog fixed this one on July 27. CVE-2026-82329 is a critical authentication-bypass vulnerability that allows unauthenticated attackers with network access to obtain administrative privileges. JFrog published a patch for it on August 28. Earlier this month, security researchers told The Register that miscreants began battering internet-exposed systems vulnerable to CVE-2026-82329 just four days after JFrog disclosed the bug. In addition to creating new administrative credentials, watchTowr’s honeypot network caught miscreants “enumerating users, groups, credential sets and federated access topologies,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr. The one thing everyone agrees upon is that attackers didn’t start exploiting any of these CVEs until after JFrog issued fixes. In a Thursday report, Wiz security researchers “confirmed in-the-wild exploitation of all three vulnerabilities across multiple environments,” and noted that “patching velocity has been slow.” JFrog has not responded to any of The Register’s inquiries about attacks against any of the three CVEs. 'Patching velocity has been slow' Six weeks after JFrog disclosed CVE-2026-42016, 59 percent of organizations remain vulnerable, and 62 percent remain vulnerable to CVE-2026-42018 after four weeks. Organizations have been quicker to remediate the critical bug, CVE-2026-82329, although 49 percent remain vulnerable two weeks after its publication, according to Wiz. Beginning August 15 and running through September 8, Wiz spotted “multiple” attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances to gain admin access. Many of these intruders then dropped a custom Rust backdoor to establish command-and-control (C2) capabilities. While the post-exploitation activity varies, Wiz reports observing attackers doing all types of mischief with their administrative access to compromised Artifactory instances, including establishing persistent admin accounts, installing Groovy plugins to achieve remote code execution on the server, executing shell commands run through the plugin to perform reconnaissance and scan for sensitive files, deliver second-stage payloads, and upload web shells. Then, between September 1 and 8, Wiz saw “several” attackers exploiting CVE-2026-82329. These intrusions were not a “unified attack chain by a single threat actor,” but spanned multiple illicit behaviors including exfiltration of configuration details, establishing persistent admin accounts, token minting for long-lived credentials, stealing keys, attaching their own SSH keys to created users in some cases, and enumerating users, repositories, and tokens. If you haven't already, patch vulnerable instances Wiz advises - and we strongly concur - upgrading to a fixed Artifactory version as soon as possible. “Given that exploitation may be possible remotely without authentication under the default configuration, organizations should prioritize internet-accessible Artifactory instances and restrict network access to trusted users and systems where possible,” the researchers added. “Organizations should also review Artifactory authentication and administrative activity for unexpected privileged access.” These latest exploits follow a rough few months for JFrog's package management system, which has been under fire from both human and AI attackers. OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting an Artifactory zero-day in July, and at Black Hat, the model provider said agents used Artifactory to build message boards and help each other access the open internet. ®

source https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943

Read More

Age verification exemptions for open source operating systems feel like Phyrric victories

On the Windows side of the age verification question, Microsoft is obviously following trends among lawmakers the world over.

To address this, Windows is introducing a new platform capability: the Windows Age API. 

This API brings age awareness beyond the operating system by making it available across the entire Windows ecosystem so that apps and services can deliver age-appropriate experiences using the same trusted foundation. By making age awareness available as a platform capability, Windows helps developers build safeguards into experiences from the start rather than placing the burden on children and families to manage protections app by app. 

↫ Rob Mauceri at the Windows Blogs

Meanwhile, on the Linux side of things, there’s been some cheering as at least California passed amendments to its age verification law to exempt open source operating systems.

These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.

↫ Luke James at Tom’s Hardware

I think this is not at all the good news that many make it out to be. Exempting Linux, BSD, and other open source operating systems from age verification obligations may seem like a good thing at first glance, but in reality, I think services and applications will simply choose to not work at all on platforms that do not implement age verification. The fear of legal ramifications, especially when it involves children, will be enough for existing and future popular services and applications to exclusively work on platforms that implement age verification – whether those fears are founded or not.

In fact, I’m fairly sure a company like Microsoft, which has actually been feeling the squeeze from the Linux side recently – even if it is modestly so – is quite happy to see open source operating systems excluded from these obligations. Google, too, is probably none too unhappy to see any possible open source mobile operating system competitors not implement age verification. The fear of missing out is real, and most people are not as invested in fighting big tech and government surveillance as the average OSNews reader is going to be. If using Linux means not being able to play the latest hit games or use that new successful service, people will choose to stick with Windows or macOS.

Let me be very clear that I do not support these age verification laws in any way, shape, or form, and I definitely do not want the open source world to embrace age verification. What I’m worried about is that the open source world will cheer on these exceptions and consider the battle won, when in reality, they feel more like Pyrrhic victories. Age verification laws must be fought and destroyed at ballot boxes the world over, because otherwise I fear they will become just another tool in big tech’s toolbox, exemptions or not.

source https://www.osnews.com/story/145944/age-verification-exemptions-for-open-source-operating-systems-feel-like-phyrric-victories/

Read More

Hackers abused Claude to extract secrets from 1.8M Android apps

Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. [...]

source https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/

Read More

Florida confirms DMV database breached via stolen police account

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach, saying the attackers gained access using credentials belonging to a police department employee. [...]

source https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/

Read More

NASA and IBM open source lunar mapping tools

IBM and NASA have got together again and released an open source AI model of the Moon that could be used to make new discoveries about Earth’s natural satellite. The NASA‑IBM Lunar Foundation Model has been trained on an extensive lunar observation dataset curated by researchers at the two organizations, and is available now on Hugging Face. It is claimed as the first AI model to integrate observations captured in a range of modalities (data formats), and at different viewing angles and spatial scales. Instead of sifting through maps and images by hand or using low resolution machine learning models, scientists can use this to analyze geographic features, the pair say. In particular, NASA and IBM hope researchers will be able to discover previously unidentified lunar ice deposits, analyze volcanic features called Irregular Mare Patches, and identify and classify craters. Lunar ice indicates the presence of water and oxygen, which may be useful for future manned missions. It is found in permanently shadowed regions, which are among the most difficult areas to observe. The NASA-IBM model combines multimodal and multi-resolution observations to better predict where ice may be present on the lunar surface. Alongside the model, IBM and NASA scientists compiled an open-source lunar dataset from over 30 spatially-aligned layers, using data from nine instruments across four missions. It combines tens of thousands of images and maps showing various geophysical properties of the lunar surface. “NASA has spent decades building an extraordinary scientific record of the Moon, but collecting data is only part of the job,” said the space agency’s chief science data officer, Kevin Murphy. “We also have to make data easier for scientists to explore and use.” “The NASA-IBM Lunar Foundation Model gives scientists a foundation to explore the Moon at scale, connecting observations across instruments, revealing patterns that are difficult to see in isolation, and providing an open platform the global research community can build on,” claimed IBM director of research for Europe, Juan Bernabe-Moreno. This isn’t the first such project the two organizations have worked on together. In 2023, the pair released Prithvi, an open-source foundation AI model to help scientists analyze satellite imagery. A year later, they released an AI climate model designed to accurately predict weather patterns, extending the Prithvi family of models. Last year, it was an AI model named Surya, developed to predict the kind of violent solar flare-ups that might disrupt satellites and spacecraft. This was also part of the Prithvi family, as is the Lunar Foundation Model. NASA and IBM have not officially disclosed a specific parameter count or exact model size for this latest release. As it is open-source and available to download, we asked what resources someone would need to use it. “Hardware needs will depend on the application, the size and number of inputs, and whether they’re running predictions or further training the model. As a rule of thumb, most of our fine-tuning experiments were conducted using Nvidia A100 GPUs,” an IBM spokesperson told us. “Smaller-scale experiments and inference workloads may be possible on more modest hardware, although the exact requirements will vary depending on the task.” Perhaps Reg readers will be able to make some discoveries using the new foundation model? Finding the craters made by rogue rocket stages, for example, or looking for evidence of little green men?®

source https://www.theregister.com/ai-and-ml/2026/09/10/nasa-and-ibm-open-source-lunar-mapping-tools/5295633

Read More