Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]

source https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/

Read More

The improbable music of the ZX Spectrum's one-bit speaker

Even for 1982, the Sinclair ZX Spectrum had poor sound: a piezoelectric speaker that could beep. But you can do a lot with a single bit if you turn it on and off really fast. Michael Martin's Bumbershoot Software site has done some fascinating deep dives into several long-gone computer systems, including a whole series on implementing a game on the ZX Spectrum, starting in May with Giving the ZX Spectrum a Fair Shake. More recently, though, Martin turned his attention to the Spectrum's very limited sound capabilities. As we write, his newest post is Experimenting With 1-Bit Sound. The post concerns the original 16K and 48K ZX Spectrum models, not the Spectrum 128, with its fancy AY-3-8912 sound chip (also found in the US Timex Sinclair 2068). Even as devoted Spectrum enthusiasts, we didn't expect an article about the machine's limited sound hardware to lead to hours of listening pleasure. The Manic Miner intro music, after all, is a fair representation of early Spectrum chiptunes. (Turn your speakers way down before you listen!) The ZX Spectrum could play music from the outset – Steven Vickers' original Spectrum BASIC Manual includes the code for a tiny fragment of Mahler. As The Register reported in 2015, Matt Westcott's Mahler Project used a networked collection of original Spectrum computers to play all the parts of Mahler's First Symphony. Over at Bumbershoot Software, Martin is interested in programming the very limited hardware of these early home computers, and so his Spectrum audio post discusses audio-encoding methods, pulse-width modulation, and more in considerable depth. Toward the end, it links to a remarkable music demo called We are Vocoders. A discussion among Spectrum aficionados on Hacker News then led us to the astounding work of Tim Follin in the 1980s. (The Video Game Music Preservation Foundation has an excellent profile, including a contemporary photo. Dean Benfield's touching tribute to his brother Geoff has a more recent picture.) Follin hand-coded the music for Spectrum games such as Mastertronic's Agent X… And indeed Agent X II… And Raw Recruit… There are many more remarkable Follin tracks, including the music for Future Games, and the title music for Chronos. Follin achieved this without additional hardware such as the RAM Music Machine – which even impressed the great Aphex Twin. There are also some very impressive demos, such as Dark Fusion by the late Ben Daglish. Rich "Tufty" Hollins even created an entire half-hour album of one-bit audio, ON and OFF. You can listen to it in its entirety on Bandcamp, or accompanied by some Spec-tastic graphics on YouTube. ®

source https://www.theregister.com/offbeat/2026/09/13/the-improbable-music-of-the-zx-spectrums-one-bit-speaker/5295862

Read More

Security through obscurity is dead, and AI delivered the fatal blow

The term "security through obscurity" describes an old idea that networks and systems will remain secure so long as their architecture, along with any vulnerabilities or other weaknesses, remains secret or hidden. It was never a sound strategy for protecting sensitive assets and systems, but many organizations leaned on it due to lack of resources or complacency. Now it’s obsolete. Don’t believe us? Here’s proof. Software vendors and independent researchers alike are now using AI agents to find bugs – some very obscure and decades old – across products and open source code, leading to record-breaking numbers of security disclosures and patches, and a massive backlog for project maintainers. “You see open source platforms that have been visible to the tech community for a decade, these libraries that are run in 80 percent of web servers out there, people have stress-tested those for 10 years, and the community believed that they were really secure,” Brett Leatherman, assistant director of the FBI's Cyber Division, told The Register. “The latest models were able to break those and say, ‘yeah, there’s significant vulnerabilities in here.’” Whether or not security through obscurity is dead “isn't even an opinion question,” Trend Micro’s Zero Day Initiative chief bug hunter Dustin Childs told The Register, the day after Microsoft’s record-breaking Patch Tuesday addressed 974 CVEs. “When you look at all of the components patched by Adobe and Microsoft yesterday, you see components no one has talked about in years,” Childs said. “Telnet client – is this even still used in any secure environment? Windows RNDIS – the USB-networking protocol Microsoft has been trying to deprecate for years. NFS Portmapper – 1980s Unix tech. And Link Layer Topology Discovery – the Vista-era network-map protocol nobody's thought about since Vista – just to name a few.” Meanwhile, attackers are also using AI to reverse-engineer fixes and find exploits within hours. In one recent case, at least four espionage crews, most suspected of links to China, slammed shut the “patch-gap” window for open source Chromium, using an exploit kit developed shortly after the maintainers released an upstream patch – but before the downstream stable release was pushed to users. What this means for OT security During interviews at Black Hat in August, both former US National Cyber Director Chris Inglis and John Hultquist, chief analyst at Google Threat Intelligence Group, told us that they worry about what this means for critical operational technologies and industrial control systems (ICS). These are the systems that ensure the lights turn on when people flip a switch, gas flows out of pumps, and safe drinking water pours from faucets – all critical services that people use daily, and assume will continue working reliably. The OT systems themselves often use obscure protocols and proprietary hardware and software, which historically made them black boxes, even to IT specialists and hackers. AI upended this assumption. It means that criminals don't need to be OT experts to carry out destructive cyberattacks on critical networks and facilities. They just have to ask an agent to learn everything about these systems and do the dirty work for them. A couple of weeks after Black Hat, five US agencies said that attackers used AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers (PLCs) at water, manufacturing, energy, and other critical facilities. “This is not a theoretical risk – it is an active threat,” the feds warned. AI “is excellent at technical troubleshooting, at knowing obscure systems and helping you make your way through it, and this makes me very concerned about industrial control systems,” Hultquist told The Register in an interview last week. “They've been largely secured because the expertise was in a handful of people's heads, and that's not going to last forever,” he said. AI can be a useful guide for attackers studying not just the application layer, but also the operating system, and even down into the firmware, Hultquist added. “That's going to have implications for a lot of different areas of security, but definitely for industrial control systems.” However, while this undoubtedly means more work for sysadmins and defenders, burying this outdated idea of security through obscurity isn’t necessarily a bad thing. 'Never a winning strategy' “I've always been of the mind that security through obscurity was never a winning strategy,” Katie Moussouris, founder and CEO of bug bounty consultancy Luta Security and the fairy godmother of bug bounties, told The Register. “But that's because I've been a hacker for so long. The argument always fails in the face of someone who decides to turn their gaze towards your organization. If there is something to find, they will find it.” Plus, she added, AI makes hacking a whole lot easier. “People might not have familiarity with the particular tech stack that you're running, but that is no longer a barrier because AI has ingested everything, and an AI is going to help them enumerate weak spots, even if they themselves are not familiar with the particular tech stack that they are pointing an AI towards,” Moussouris said. However, finding bugs and other weaknesses has never been the big security problem, she added. “It’s triaging and prioritization and actually getting things fixed.” This, Moussouris said, has also been her biggest issue with the way that organizations implement bug bounty programs. “AI is shining that bright light on the wrong end of the security picture, and unfortunately, AI hasn't caught up on the defensive side,” Moussouris said. “We're not there with AI automated patching, remediation – anything of the sort.” A couple of recent studies back this up, both finding that AI-generated patches fail more than half of the time. 1Password’s research team took six CVEs disclosed since March, and produced 6,080 patches using two frontier models: OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. “The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0 percent,” wrote Director of Security Research Keith Hoodlet, adding that even patches that did fix the flaw also mucked up the application’s behavior 20 percent of the time. This included things like changing “allow list” logic to “deny list” logic. “Conversely, LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both, an average 53.9% of the time,” Hoodlet said. Another study by app security shop Veracode found that, across more than 100 models and 80 coding tasks, the average security pass rate for AI-generated code was just 56 percent. “If people are telling you that you need to accelerate on the fixing side, and the defense side – that’s just not cutting it,” Moussouris said. “Orgs that are looking at this as we're going to throw more resources at finding and fixing bugs, and they're not investing in taking a look at their process failures that led to so many bugs – those organizations are going to die on the treadmill,” she added. “They will literally have a heart attack and die. Like there's no VO2 max that will make you fast enough to deal with all those bugs, and giving up is not the answer.” The answer, she says, is taking a more dynamic approach, assessing where your organization can find patterns that lead to a process improvement instead of patching vuln after vuln. “A lot of organizations don't even know how to measure their progress, so they are counting bugs and speed of fixing, which is one way to measure. We had this many criticals, and then we fixed them super fast, and we had this many high, this many medium,” Moussouris said. The number of flaws fixed is important, but it doesn’t show the entire picture, she added. This involves looking at types of vulnerabilities, too. “Like: We've got a lot of injection flaws. That's something we could solve with better, safer templates earlier in our CI/CD pipeline. This is something that we can prevent at scale, as opposed to fixing these like really easy to find and fix vulnerabilities really really fast.” ®

source https://www.theregister.com/security/2026/09/13/security-through-obscurity-is-dead-and-ai-delivered-the-fatal-blow/5296000

Read More

How to make Xfce look like almost any desktop you want

PART 1 Xfce is one of the oldest and smallest desktops, but it's also one of the most malleable: it can look and work like multiple other OSes. Best of all, an optional extra Xfce tool automates away most of the configuration. Xfce has been around for 30 years, undergoing several facelifts while remaining one of the most configurable and lightweight Linux desktops. It started off looking like CDE, then it evolved into something more like Windows 95 before developing its own identity. The good news, though, is that you don't have to spend hours right-clicking and twiddling options to give it a whole new look. It has its own tool for this, called Panel Profiles. It's an optional extra that does the same job as Zorin OS's Appearance tool: it lets you flip between predefined desktop layouts in two clicks. It works on the fly, without even requiring you to log out, and you can also define and save your own custom layouts. With Panel Profiles, you can make Xfce resemble various versions of Windows, Xubuntu, Xfce itself, MATE (or GNOME 2, if you're nostalgic), Mac OS X, or Ubuntu Unity. In Part 1 of this two-part workshop, we'll show you how to install Panel Profiles and the extra components that let it really flex Xfce's muscles. To get the most out of some of the more unconventional layouts, you do need to do a little under-the-hood reconfiguration, and in part 2 we'll cover how to do that: it involves adding a few lines to plain-text files and doing a little manual point-and-click panel tweaking. Before the Qt advocates start shouting at us, it's true that KDE Plasma can do most of this too. The difference is that, as far as we've been able to find, KDE has no automatic layout-switching tool, while Xfce's Panel Profiles does most of the grunt work for you. In KDE, you'll have to DIY ("Do It Yourself," for non-Brits) and learn to navigate KDE's hundreds of settings in dozens of dialog boxes. With Panel Profiles, Xfce makes it much easier – and as our Ubuntu flavor comparison showed, Xfce does it in less code, using less RAM and less disk space. In the vain hope of forestalling questions, we thought we'd explain why we want it. This vulture still uses Ubuntu Unity on several laptops. We really liked the Unity desktop in 2011 and we still do. It's space-efficient on a small screen, but also makes effective use of multiple large screens. Having the Dock app launcher and switcher at the side of the screen is space-efficient, and for fullscreen or tiled apps, it should be on the opposite edge from scrollbars: NeXT put the Dock on the right, but then NeXT put scrollbars on the left. Scrollbars are on the right in all modern GUIs, so the Dock-analog should be on the left edge. The other great thing about Unity is that you can navigate it almost entirely with Windows keystrokes. However, Canonical no longer maintains Unity as Ubuntu's default desktop, and it is not widely packaged outside Ubuntu, while Xfce runs on Linux distributions and BSDs alike. Early this year we tried the Desktop Classic System, a clever Debian remix that uses a customized MATE desktop to provide a spatial desktop: icons and windows remember their locations, stay where they're put, and reappear in the same position when you re-open them. This was one of the most useful but little-appreciated features of classic Mac OS, before it was replaced by Mac OS X (later rebranded just "OS X" and now "macOS" with a small "m"). We liked DCS, but it does have some drawbacks, and for us the big one is that there's no global menu bar. For us, this is also one of the main drawbacks of Elementary OS, which is one of the best-looking desktop distros. Without a menu bar, both have a yawning, empty panel stretching right across the screen with 95 percent of its space wasted. The same is true of GNOME, and although you can fix that with extensions, the result is fragile and it can't do anything about windows conventional title bars, with their standard control buttons, and many of GNOME's other eccentricities. The spatial desktop of the original MacOS was great and we miss it – but these days, a quarter of a century after its replacement arrived, we like tiled windows more. However, for us, a global menu bar is even more useful. Putting the dock's functionality on a separate panel works too: on a smaller screen, you can set it to auto-hide, and switch apps with Alt+Tab. Yes, we know, KDE can do this too, but getting there requires delving deep into KDE's thousands of config settings. Xfce makes it easy, and it is smaller, simpler, and has a relatively slow release cadence. We find Xfce faster, more responsive, and beautifully clean. For the demo, we used plain Debian 13, but the same methods work with MX Linux, Xubuntu, and Alpine Linux, and should also work on openSUSE, Fedora, and other distributions that offer Xfce. When installing Debian, we chose the "desktop" option, cleared the GNOME option, and selected Xfce instead. If you are more used to using sudo than logging in as root for admin tasks, a top tip: when the installation program asks for a password for the root account, just leave it blank. In the next step, when you create a user account, the installer will automatically enable sudo and leave the root account disabled. Step 1 – automating the basics To try Xfce's Tleilaxu face-dancing powers, you need Panel Profiles – but most distros don't install it by default. On Debian, it's as simple as sudo apt install -y xfce4-panel-profiles. On Debian 13, that's it. In the past, we have seen it fail on other distros due to a missing dependency: Panel Profiles also needs the Python psutil module. On Debian-like distros, just run apt install python-psutil. Once you've got Panel Profiles, you can choose among multiple predefined layouts. We suspect their names were chosen not to infringe on any trademarks, but we find them fairly self-explanatory: Cupertino – named after Apple's hometown, this is a somewhat macOS-like config. GNOME 2 – although these days MATE might be more appropriate: a layout with two full-width panels at top and bottom; the top one has app launcher menus and a system tray, and the bottom has window and virtual-desktop switchers. openSUSE Leap 15.x – a Windows 95-style layout, with some Linux improvements: a single panel at the bottom, the more capable Whisker menu first, then a "show desktop" button and a virtual desktop switcher at the right. Redmond – a very minimal Windows 95 layout, meaning the basic Applications menu with no search, no virtual desktops, no app launchers, and no show-desktop button. Redmond 7 – more like Windows 7: searchable Whisker menu, big icon buttons for windows instead of rectangular buttons with text labels, and a show-desktop button at the end of the panel. Unity – similar to the Unity desktop layout, with a full-height application-launcher panel on the left and a panel with a menu bar and status indicators at the top. There are several more, including multiple historical versions of both Xfce's own default layouts, and those of several older versions of Xubuntu. For our purposes, though, we're mainly interested in the "Cupertino" and "Unity" profiles. These are quite similar: both have a top panel with an application menu on the left, status icons on the right, and a global menu bar between them, plus a dock-like second panel. The main differences are that Cupertino centers the dock at the bottom, while Unity has it spanning the whole left edge. Cupertino puts an app launcher at the start of the top panel, while Unity makes it the first entry in the dock. That's about it. Naturally, this being Xfce and configurable, you can move either of these elements if you prefer them somewhere else. But first, a warning: don't try to choose these profiles yet! To get even basic versions of either profile working, you must install some extra components… and to witness the full power of this fully configurable and operational Unix desktop, you'll need to do a little extra legwork, as we'll get to in Episode Two. Manually satisfying Panel Profiles' needs There is one significant stumbling block: installing Panel Profiles does not install the Xfce components its layouts require. You must install them yourself before trying a given profile. If you don't, the tool will quit, leaving you with no panels at all. This is less than ideal, but if it happens, don't panic: right-click the desktop and you can log out. When you log in again, most of the desktop should work. For the global menu bar in "Cupertino" and "Unity," you must install a package called xfce4-appmenu-plugin. This uses the Vala panel global menu, and installing the Xfce plugin should automatically pull the relevant dependencies, including vala-panel-appmenu-common, appmenu-registrar, appmenu-gtk3-module, and appmenu-gtk-module-common. The "Unity" profile also needs another plugin, which moves window-control buttons into the top panel. If it's missing, Panel Profiles complains that it can't find wckbuttons. To avoid that, install xfce4-windowck-plugin. The Xubuntu profiles require another plugin for indicators; to get them working, install xfce4-indicator-plugin. The Xubuntu profiles also want another plugin, but the error message only tells us that (null) is missing, so we haven't been able to work out exactly what it is. As a workaround, we simply installed all the optional packages starting with xfce4- – it's the crude sledgehammer approach, but doesn't use much space. (We suggest excluding xfce4-dev-tools, unless you want to recompile Xfce for yourself – this metapackage pulls in a large number of compilers and other development tools.) Once you've installed all the dependencies, all the Panel Profiles layouts should work. The Cupertino layout pins the app menu to the start of the top panel, where it acts a little like the Apple Menu on a Mac. The Unity layout replaces this with the Whisker menu, configured as a full-screen application launcher and placed as the first button on the panel down the left-hand side. You can hop between layouts on the fly using the Panel Profiles tool. Xfce remembers the last layout selected by each user account and reloads it at the next login. You can explore how they are constructed by examining each panel's controls, then repositioning them or adding your own controls and applications. However, we're not totally happy with either of them. Further customization can improve the experience, and we'll explain how in Part 2. ®

source https://www.theregister.com/software/2026/09/13/how-to-make-xfce-look-like-almost-any-desktop-you-want/5295775

Read More

More JFrog Artifactory bugs under attack, and all 3 have patches

JFrog Artifactory instances continue to get hit hard. Multiple attackers are exploiting three JFrog Artifactory bugs to gain administrative control over vulnerable instances - in some cases, just days after the vendor published a patch - and then using this illicit access to install malicious plugins and backdoors. The three vulnerabilities are: CVE-2026-42018 is a high-severity, improper authentication flaw that can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled. An attacker can use this token to authenticate to the repository manager and then access sensitive resources. JFrog patched this vulnerability on August 12. CVE-2026-42016 is a high-severity privilege-escalation bug. Artifactory doesn’t properly validate the token’s scope, and this can allow an attacker with low-privileged access to elevate privileges and perform actions that they should not be allowed to do. JFrog fixed this one on July 27. CVE-2026-82329 is a critical authentication-bypass vulnerability that allows unauthenticated attackers with network access to obtain administrative privileges. JFrog published a patch for it on August 28. Earlier this month, security researchers told The Register that miscreants began battering internet-exposed systems vulnerable to CVE-2026-82329 just four days after JFrog disclosed the bug. In addition to creating new administrative credentials, watchTowr’s honeypot network caught miscreants “enumerating users, groups, credential sets and federated access topologies,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr. The one thing everyone agrees upon is that attackers didn’t start exploiting any of these CVEs until after JFrog issued fixes. In a Thursday report, Wiz security researchers “confirmed in-the-wild exploitation of all three vulnerabilities across multiple environments,” and noted that “patching velocity has been slow.” JFrog has not responded to any of The Register’s inquiries about attacks against any of the three CVEs. 'Patching velocity has been slow' Six weeks after JFrog disclosed CVE-2026-42016, 59 percent of organizations remain vulnerable, and 62 percent remain vulnerable to CVE-2026-42018 after four weeks. Organizations have been quicker to remediate the critical bug, CVE-2026-82329, although 49 percent remain vulnerable two weeks after its publication, according to Wiz. Beginning August 15 and running through September 8, Wiz spotted “multiple” attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances to gain admin access. Many of these intruders then dropped a custom Rust backdoor to establish command-and-control (C2) capabilities. While the post-exploitation activity varies, Wiz reports observing attackers doing all types of mischief with their administrative access to compromised Artifactory instances, including establishing persistent admin accounts, installing Groovy plugins to achieve remote code execution on the server, executing shell commands run through the plugin to perform reconnaissance and scan for sensitive files, deliver second-stage payloads, and upload web shells. Then, between September 1 and 8, Wiz saw “several” attackers exploiting CVE-2026-82329. These intrusions were not a “unified attack chain by a single threat actor,” but spanned multiple illicit behaviors including exfiltration of configuration details, establishing persistent admin accounts, token minting for long-lived credentials, stealing keys, attaching their own SSH keys to created users in some cases, and enumerating users, repositories, and tokens. If you haven't already, patch vulnerable instances Wiz advises - and we strongly concur - upgrading to a fixed Artifactory version as soon as possible. “Given that exploitation may be possible remotely without authentication under the default configuration, organizations should prioritize internet-accessible Artifactory instances and restrict network access to trusted users and systems where possible,” the researchers added. “Organizations should also review Artifactory authentication and administrative activity for unexpected privileged access.” These latest exploits follow a rough few months for JFrog's package management system, which has been under fire from both human and AI attackers. OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting an Artifactory zero-day in July, and at Black Hat, the model provider said agents used Artifactory to build message boards and help each other access the open internet. ®

source https://www.theregister.com/security/2026/09/11/more-jfrog-artifactory-bugs-under-attack-and-all-3-have-patches/5295943

Read More

Age verification exemptions for open source operating systems feel like Phyrric victories

On the Windows side of the age verification question, Microsoft is obviously following trends among lawmakers the world over.

To address this, Windows is introducing a new platform capability: the Windows Age API. 

This API brings age awareness beyond the operating system by making it available across the entire Windows ecosystem so that apps and services can deliver age-appropriate experiences using the same trusted foundation. By making age awareness available as a platform capability, Windows helps developers build safeguards into experiences from the start rather than placing the burden on children and families to manage protections app by app. 

↫ Rob Mauceri at the Windows Blogs

Meanwhile, on the Linux side of things, there’s been some cheering as at least California passed amendments to its age verification law to exempt open source operating systems.

These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.

↫ Luke James at Tom’s Hardware

I think this is not at all the good news that many make it out to be. Exempting Linux, BSD, and other open source operating systems from age verification obligations may seem like a good thing at first glance, but in reality, I think services and applications will simply choose to not work at all on platforms that do not implement age verification. The fear of legal ramifications, especially when it involves children, will be enough for existing and future popular services and applications to exclusively work on platforms that implement age verification – whether those fears are founded or not.

In fact, I’m fairly sure a company like Microsoft, which has actually been feeling the squeeze from the Linux side recently – even if it is modestly so – is quite happy to see open source operating systems excluded from these obligations. Google, too, is probably none too unhappy to see any possible open source mobile operating system competitors not implement age verification. The fear of missing out is real, and most people are not as invested in fighting big tech and government surveillance as the average OSNews reader is going to be. If using Linux means not being able to play the latest hit games or use that new successful service, people will choose to stick with Windows or macOS.

Let me be very clear that I do not support these age verification laws in any way, shape, or form, and I definitely do not want the open source world to embrace age verification. What I’m worried about is that the open source world will cheer on these exceptions and consider the battle won, when in reality, they feel more like Pyrrhic victories. Age verification laws must be fought and destroyed at ballot boxes the world over, because otherwise I fear they will become just another tool in big tech’s toolbox, exemptions or not.

source https://www.osnews.com/story/145944/age-verification-exemptions-for-open-source-operating-systems-feel-like-phyrric-victories/

Read More

Hackers abused Claude to extract secrets from 1.8M Android apps

Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. [...]

source https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/

Read More

Florida confirms DMV database breached via stolen police account

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach, saying the attackers gained access using credentials belonging to a police department employee. [...]

source https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/

Read More

NASA and IBM open source lunar mapping tools

IBM and NASA have got together again and released an open source AI model of the Moon that could be used to make new discoveries about Earth’s natural satellite. The NASA‑IBM Lunar Foundation Model has been trained on an extensive lunar observation dataset curated by researchers at the two organizations, and is available now on Hugging Face. It is claimed as the first AI model to integrate observations captured in a range of modalities (data formats), and at different viewing angles and spatial scales. Instead of sifting through maps and images by hand or using low resolution machine learning models, scientists can use this to analyze geographic features, the pair say. In particular, NASA and IBM hope researchers will be able to discover previously unidentified lunar ice deposits, analyze volcanic features called Irregular Mare Patches, and identify and classify craters. Lunar ice indicates the presence of water and oxygen, which may be useful for future manned missions. It is found in permanently shadowed regions, which are among the most difficult areas to observe. The NASA-IBM model combines multimodal and multi-resolution observations to better predict where ice may be present on the lunar surface. Alongside the model, IBM and NASA scientists compiled an open-source lunar dataset from over 30 spatially-aligned layers, using data from nine instruments across four missions. It combines tens of thousands of images and maps showing various geophysical properties of the lunar surface. “NASA has spent decades building an extraordinary scientific record of the Moon, but collecting data is only part of the job,” said the space agency’s chief science data officer, Kevin Murphy. “We also have to make data easier for scientists to explore and use.” “The NASA-IBM Lunar Foundation Model gives scientists a foundation to explore the Moon at scale, connecting observations across instruments, revealing patterns that are difficult to see in isolation, and providing an open platform the global research community can build on,” claimed IBM director of research for Europe, Juan Bernabe-Moreno. This isn’t the first such project the two organizations have worked on together. In 2023, the pair released Prithvi, an open-source foundation AI model to help scientists analyze satellite imagery. A year later, they released an AI climate model designed to accurately predict weather patterns, extending the Prithvi family of models. Last year, it was an AI model named Surya, developed to predict the kind of violent solar flare-ups that might disrupt satellites and spacecraft. This was also part of the Prithvi family, as is the Lunar Foundation Model. NASA and IBM have not officially disclosed a specific parameter count or exact model size for this latest release. As it is open-source and available to download, we asked what resources someone would need to use it. “Hardware needs will depend on the application, the size and number of inputs, and whether they’re running predictions or further training the model. As a rule of thumb, most of our fine-tuning experiments were conducted using Nvidia A100 GPUs,” an IBM spokesperson told us. “Smaller-scale experiments and inference workloads may be possible on more modest hardware, although the exact requirements will vary depending on the task.” Perhaps Reg readers will be able to make some discoveries using the new foundation model? Finding the craters made by rogue rocket stages, for example, or looking for evidence of little green men?®

source https://www.theregister.com/ai-and-ml/2026/09/10/nasa-and-ibm-open-source-lunar-mapping-tools/5295633

Read More

Microsoft Excel KB5002914 update breaks copy and paste for some users

Microsoft Excel users report that this week's KB5002914 Office security update is breaking copy-and-paste operations and formula dragging, with affected users saying that removing or rolling back the update restores normal functionality. [...]

source https://www.bleepingcomputer.com/news/microsoft/microsoft-excel-kb5002914-update-breaks-copy-and-paste-for-some-users/

Read More

Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking

The Carnegie Mellon University CERT Coordination Center (CERT/CC) is warning that Skullcandy Dime 3 wireless earbuds accept Bluetooth pairing requests from nearby unpaired devices without requiring user interaction. [...]

source https://www.bleepingcomputer.com/news/security/skullcandy-dime-3-earbuds-expose-users-to-bluetooth-hijacking/

Read More

Lotus Notes and the dangers of starting from scratch

Lotus Notes was the future of communications, a decade before laptops had WiFi. Yet of all things, it wasn’t even an email app. It was a notes app, a collaboration tool, an all-things-to-all-people software that let you build apps in the way Access and Airtable later would. That, and the notes could be used for email.

Love it or hate it (and there were plenty on both sides of the fence), what you couldn’t do was ignore it. This email-and-everything-else platform showed what the future of digital communications would become — and provoked, as email itself was always doomed to provoke, equal measures of awe and exasperation.

↫ Matthew Guay

I have no experience with Lotus Notes, but I do have some vague memories of the software being used at my parents’ employers back in the late ’90s. Note that Notes still exists and is in active development as HCL Domino (server) and Notes (the client). If you really want to, you can still run your company of office on Notes.

I wonder how many actually still do.

source https://www.osnews.com/story/145936/lotus-notes-and-the-dangers-of-starting-from-scratch/

Read More

Windows 11 cumulative updates KB5124008 & KB5122880 released

Microsoft has released Windows 11 KB5124008 and KB5122880 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. [...]

source https://www.bleepingcomputer.com/news/microsoft/windows-11-cumulative-updates-kb5124008-and-kb5122880-released/

Read More

HPE makes its “unified storage” claim real as B10000 R6 hits GA

Storage vendors have been calling things “unified” for years. Sometimes that means one architecture. Sometimes it means several products sharing a management screen and a marketing budget. The term has accumulated enough baggage that a little skepticism is warranted. HPE Alletra Storage MP B10000 Release 6, announced in May, is now generally available. It brings block and file onto the same disaggregated scale-out architecture and OS code base, with independent scaling of performance and capacity and native ransomware detection across both. That’s important because enterprise storage is becoming less of an array decision and more of an architectural one. HPE was recently named a Leader in the 2026 Gartner® Magic Quadrant™ for Enterprise Storage Platforms, which provides useful context, but a quadrant is still a snapshot. GA code is where the architecture has to prove itself. Unified, but not universal The B10000 is not intended to become the answer for every file workload in the data center. Massive-scale, performance-oriented unstructured workloads such as AI, analytics, EDA and media remain better suited to HPE Alletra Storage MP X10000. The aim with the B10000 is narrower and, arguably, more useful: consolidating block and adjacent file workloads onto a common architecture without forcing customers to scale controllers and capacity together. That distinction matters. Vendors have offered “unified” storage before, but the harder question is what is actually shared underneath: protocols, scaling model, software stack and operational experience, or simply the management layer. The architecture is the product The B10000 separates compute from capacity with a “shared-everything” architecture, allowing each to scale independently rather than requiring customers to buy fixed controller-and-media increments. Release 6 extends that model across block and file while retaining a common operating environment and management plane. The interesting part is therefore not simply the addition of file protocols. It is whether customers can consolidate block and the file workloads that naturally sit alongside them without recreating the infrastructure silos they were trying to remove. Disaggregation also changes the economics. If performance and capacity requirements grow at different rates, the infrastructure can follow those curves separately rather than making one drive the other. AI moves closer to operations Release 6 also extends HPE’s AI-driven operations model. Within HPE Data Services Cloud Console, autonomous health assessments can evaluate areas such as capacity and performance, while Storage Copilot provides natural-language interaction, recommendations and the ability to take actions. Agentic Support Automation pushes that model further. Unlike legacy support approaches that depend on known issue signatures, predefined rules or thresholds, it is signature-less: AI agents continuously analyze operational behavior to detect emerging anomalies, investigate likely causes and help drive remediation—even when the specific issue has not been seen before. Capacity exhaustion is a useful example. Total system capacity can appear stable and generate no alert while a single service begins consuming capacity at an unusual rate. Traditional monitoring may not react until a threshold is crossed; agentic support automation can recognize the behavioral shift earlier, connect it to the underlying operating condition and help initiate corrective action before the change becomes a disruption. That is probably the more useful test of the increasingly fashionable word “agentic.” The question is not whether AI appears in the interface, but whether the software can move from describing an infrastructure problem toward helping resolve it. Cyber resilience becomes layered Ransomware defense follows much the same architectural logic. The B10000 now provides native real-time detection across block and file, while Zerto adds protection at the application layer and StoreOnce provides integrated data protection and recovery. No single feature solves ransomware. The more interesting model is multiple detection and recovery mechanisms operating at different points in the stack. Storage competition moves beyond the array None of this means the array is dead. Someone still has to store the bits. But the competitive unit is getting larger. Controllers, media and IOPS still matter. Increasingly, so do the operating model, cyber-resilience architecture, scaling economics and the ability to support multiple data types without multiplying infrastructure silos. The term “unified storage” has been stretched pretty far over the years. What matters now is whether the unification extends below the management layer and into the architecture itself. For more information, visit HPE Alletra Storage MP B10000 web page. Contributed by HPE

source https://www.theregister.com/storage/2026/09/08/partner-content-hpe-makes-its-unified-storage-claim-real-as-b10000-r6-hits-ga/5294566

Read More

220 million traveler records exposed in Vietnam-linked APIS leak

Exclusive: An exposed Advance Passenger Information System (APIS) database held 220 million passenger and crew records containing names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. Researchers accessed the Vietnam-linked system through a cloud-based path using default credentials. [...]

source https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/

Read More

‘Global reckoning’ is coming for big tech, says Australian minister

Australia’s government will introduce legislation that tries to regulate digital services and impose a “digital duty of care.” “For too long, tech companies have been running real-time, unregulated product testing on Australians,” Minister for Communications Anika Wells said today. “In the same way that we have safety standards for cars, for food, and for appliances, Australia is getting basic safety standards for the online tools and online services,” she added. “Tech companies will still be allowed to move fast, but they will not be able to break things.” Meta, in its early years when still known as Facebook, used the term “Move fast and break things” to describe its internal processes for creating and updating its services. The premise of Australia’s plans is that Meta, and other digital platforms, broke far more than they intended in pursuit of profit. Prime Minister Anthony Albanese framed the planned digital duty of care as a successor to the law that means social media companies are not allowed to provide accounts to children aged under 16. “We would no longer let Australian children be treated as commodities,” he said. “We have the opportunity to shape tech for the better, rather than have it shape us.” The proposed law aims to shape tech by requiring social media companies to give Australian users the chance to determine what they see in their feeds. Some in Australia have criticized the planned law as government censorship. Albanese tried to counter that notion by summarizing the intent of the plan as “My feed, my way.” “This is not about giving government control,” Albanese said. “It is about giving people control.” Wells explained those controls would be implemented with a requirement for digital platforms of offer Australian users the chance to opt into a user experience that only shows content from accounts they already follow online. She said users will be able to opt back into an algorithmic feed and change their minds about what they want to see as often as they like. However, the law will also mean the relevant minister can seek a vote to ban certain content. Albanese said the draft bill seeks to do that for content that glorifies crime, promotes terrorism, pertains to eating disorders, pornography, sexual violence, and misogyny. Wells explained that the process of declaring content harmful would start with the relevant minister consulting with Australia’s e-Safety Commissioner, who will be able to recommend that certain types of content be declared harmful. That recommendation would be subject to a parliamentary vote before coming into force. Finding precedents in a bottle The use of the term “digital duty of care” is a reference to one of the foundational cases in the law of torts – 1932’s Donoghue v Stevenson, which concerns a woman who poured a bottle of ginger beer over ice cream and watched in horror as a decomposed snail slid into her snack. Donoghue later suffered a bout of gastro-enteritis. The landmark case found that the maker of the ginger beer – and any other provider of goods and services – has a responsibility to avoid any foreseeable harms caused by their acts or omissions. The case made the concept of a duty of care central to the law of torts, which cover civil harms. Australia naming its digital regulations a “digital duty of care” therefore puts the proposal firmly in the heart of western legal tradition. At the press conference announcing the planned legislation, Albanese and Wells called on parents whose children took their own lives after using social media, and advocates for tighter regulation of social media – all of whom were unsurprisingly in favor of the law and praised the government for having the courage to advance it. When discussing Australia’s social media ban, Albanese nearly always admits it is not perfect and would not mean all Australian children under 16 immediately vanish from social media. “We knew it would not be perfect but would not let that be the enemy of the good,” he said today, and then said Australia’s policy “Started a global movement” that has since seen over 20 countries impose social media bans for children. The PM suggested a digital duty of care could catch on, too, and Wells agreed. “There is a global reckoning coming for big tech,” she said. “And it started in Australia.” ®

source https://www.theregister.com/legal/2026/09/08/global-reckoning-is-coming-for-big-tech-says-australian-minister/5294909

Read More

Huawei proudly shows off an entirely un-American chip

Huawei has launched a new processor it claims is free of US technology and is using it to drive a new three-screen folding phone. The Chinese giant dubbed the new processor the Kirin 950 Pro and says its LinxiCore processor cores, GPU, and neural processing unit all feature its own designs. The SoC into which Huawei added them uses the "Tau Scaling” architecture that Huawei says arranges components closer to each other to reduce die size and improve performance without needing the kind of advanced chipmaking processes practiced by TSMC and Intel. As The Register wrote when Huawei announced Tau Scaling last May, analysts think Huawei has done interesting things with its silicon but don’t think the company has made any breakthroughs. Huawei begs to differ and says its new silicon offers 42 percent higher performance than the chip it used in the three-screen phone it delivered last year. The Chinese company uses the Kirin 950 Pro in its new three-screen phone, the $2,979 Mate XT2. Analyst firm Counterpoint thinks Huawei will exit 2026 with 24 percent of the total folding phone market, which it believes accounted for 1.6 percent of smartphone sales last year. Huawei therefore has itself a chip that targets the high end of a market niche – and announced it a couple of days before pundits believe Apple will debut a folding iPhone that Counterpoint predicts will win 25 percent of the folding phone market by the end of the year. Huawei’s Kirin 950 Pro will therefore hardly make a dent in the smartphone market. At its launch event, Huawei execs pointed to its totally-not-Android versions of HarmonyOS now running on 85 million devices. That’s strong uptake since Huawei delivered the OS in October 2024. Again, however, it is a fraction of the overall smartphone and smart device market. If Huawei can use the tech it created for the Kirin 950 Pro in other roles that would allow mean Chinese to avoid comparable products from AMD, Intel, or Nvidia, its new chip will show that Chinese firms can create tech that reduces the nation’s reliance on imports. But amid all the hoopla of a phone launch, Huawei hasn’t said anything about its intentions to adapt its new chip for different roles. The Tau Scaling architecture is therefore not going to upset Huawei’s rivals for some time, although western chipmakers do know that Beijing is steering local buyers away from their products and encouraging adoption of local alternatives. Whether any of those Chinese chipmakers succeed beyond the Middle Kingdom is the wider question. China emphasizes export of consumer products as a tactic to fuel domestic growth, and its smartphone makers Xiaomi, Oppo, and Honor have delivered on that mission by winning solid sales across Europe, Africa, and Latin America – with phones running Android and tied to Google services. Huawei’s hardware and HarmonyOS ecosystem, by contrast, have not racked up notable success outside China. ®

source https://www.theregister.com/systems/2026/09/08/huawei-proudly-shows-off-an-entirely-un-american-chip/5294900

Read More

Thailand pauses all datacenter builds and approvals

ASIA IN BRIEF Thailand’s National Economic and Social Development Council last week decided to pause all datacenter builds in the country, while it works out appropriate regulations. The Council announced the pause last Friday in a communiqué issued after a meeting of its Datacenter Business Policy Committee, at which Thailand’s Prime Minister and Interior Minister Anutin Charnvirakul said datacenters are an important part of the nation’s economy – but admitted his government doesn’t have good data about how many of the facilities currently operate, or the pipeline for new builds. That’s quite an admission as community disquiet with datacenter development has become an issue in Thailand. The Council’s development approval pause gives operators and investors a week to submit info about their operations, to help the government expedite development of a unified regulatory framework for datacenters. Bangkok also wants to develop a plan to determine how many datacenters Thailand needs, and the format of those facilities. The Council’s starting point is to consider all datacenters using more than 2 MW of electricity as industrial businesses, consider the introduction of “resource utilization fees” so that indirect costs that flow from datacenter builds don’t increase costs for the public, and establishment of an assessment process for future builds to ensure that new datacenters “create the most benefit for Thailand.” The government hopes that the result is a datacenter ecosystem that will “create tangible and sustainable added value for the Thai economy.” Fujitsu yet not budgeting Horizon compensation The chief financial officer of Japanese tech giant Fujitsu last week told Japan’s Nikkei that the company hasn’t yet budgeted to pay compensation for the disastrous Horizon project at the British Post Office. “We are waiting for the results of the statutory inquiry,” said Takeshi Isobe. “We haven't factored compensation payouts into our earnings forecast for the year ending March 2027, and the amounts and timing of any spending on that have yet to be determined.” In the interview with Nikkei, Isobe also said Fujitsu “won't be mass-producing commodity-grade products.” Thar remark suggests Fujitsu will likely continue its withdrawal from PC and server markets around the world. NEC may have quit quantum Another Nikkei report from last week claims NEC has decided not to commercialize a quantum computer it developed in-house. The report says NEC thinks getting the machine to market will take so long that return on investment will likely prove elusive. South Korea developing its own cybersecurity model Naver, a South Korean tech giant, last week announced that it will lead an effort to build a foundation AI model focused on security. South Korea’s Ministry of Science and IT wants the model to give the country sovereign bug-finding capacity and sought local companies to build it. Naver got the gig and said it plans to throw 4,000 Nvidia B200 GPUs at the project, which will rework its existing HyperClova X and ExaOne models into a pair of 700-billion parameter models. Naver will work with 33 other South Korean companies on the project – including LG, which will contribute 256 of its H200 GPUs to the effort. Also last week, South Korea’s government staged a meeting to launch the “AI for all” project, which aims to create a government-operated chatbot that will be free for citizens. DeepSeek may be going deep on Huawei GPUs According to a Bloomberg report, Chinese AI upstart DeepSeek plans to buy over 160,000 Huawei GPUs to power a new inferencing datacenter. DeepSeek apparently has its eye on Huawei’s Ascend 950DT, a chip that boasts impressive performance but can’t match Nvidia’s top products. If DeepSeek is indeed buying Huawei kit in such quantities, it suggests China’s government is not likely to authorize imports of Nvidia hardware and is more often enforcing its policy of politely insisting local tech companies shop at home. APNIC advances leadership diversity debate The Asia Pacific Network Information Centre (APNIC), the regional internet registry for the Asia Pacific region, has advanced discussions on improving the diversity of people who serve in community leadership roles. The issue was the subject of a passionate question at the organization’s February conference, at which one member pointed out that APNIC’s elected leaders are all men with technical backgrounds, and that leadership hardly ever changes. APNIC last week published a summary of its consultations on the issue, which saw its members express a desire for the org to share more information about what is involved in becoming a community leader, and advantages such as coming from larger economies that help incumbent leaders to remain in their positions. APNIC will commence a second round of consultation at its September conference. ®

source https://www.theregister.com/off-prem/2026/09/07/thailand-pauses-all-datacenter-builds-and-approvals/5294688

Read More

ChatGPT Astra is now rolling out to $20 Plus subscription

OpenAI is now rolling out ChatGPT Astra, its most powerful model to date, to those with a $20 Plus subscription, but there's no word on when free users will get access.. [...]

source https://www.bleepingcomputer.com/news/artificial-intelligence/chatgpt-astra-is-now-rolling-out-to-20-plus-subscription/

Read More

Attackers conceal phishing lures using invisible Unicode characters

Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. [...]

source https://www.bleepingcomputer.com/news/security/attackers-conceal-phishing-lures-using-invisible-unicode-characters/

Read More

Time lords prepare to kick leap seconds into the next millennium

The prospect of a negative leap second – combined with decades of irritation over leap seconds generally – looks set to inspire a bit of global procrastination among international timekeepers. Next month, the General Conference on Weights and Measures is set to vote on effectively calling time on leap seconds. A draft resolution [PDF] would make Coordinated Universal Time (UTC) continuous from May 20, 2027, and allow the difference between UTC and UT1, a measure of time based on Earth's rotation, to reach as much as one hour. Leap seconds keep UTC, which is based on atomic clocks, within 0.9 seconds of time determined by the slightly wobbly rotation of our home planet. Since the system was introduced in 1972, 27 leap seconds have been added to UTC. The urgency comes partly from a slight increase in Earth's rotational speed in recent years, raising the possibility of an adjustment never attempted before: a negative leap second. Experts convened by international timekeeping bodies estimated a 30 percent probability that one would be needed by 2035. Many computer systems were designed on the assumption that a leap second would always be added rather than removed, explained Setnam Shemar, principal scientist at the UK's National Physical Laboratory (NPL). "Most digital architectures and network time servers are hardcoded under the assumption that leap seconds are strictly additive. Losing a second could trigger severe disruption across critical national infrastructure, including telecommunications, electricity grids, and satellite navigation systems," he said. The risks posed by a negative leap second – and leap seconds generally – are behind the proposal to let UTC diverge from rotational time by as much as an hour, which is due to be put to a vote in October. Shemar said the proposal would remove the need for further leap-second adjustments for many years. "This would remove the risks entirely for a very long time. Next month's resolution is likely to pass since it will be based on the outcome of a majority vote of the national delegates from many different countries, and most of them have been keen to end leap seconds for several years due to the risks posed to national infrastructure." UTC would be unlikely to diverge from rotational time by a full hour for at least a thousand years, Shemar said. If humankind lasts that long, it might be the least of our worries. ®

source https://www.theregister.com/offbeat/2026/09/06/time-lords-prepare-to-kick-leap-seconds-into-the-next-millennium/5294538

Read More

US troops can still be tracked by purchased location data, and Congress wants to know why

The US military's effort to prevent troops from being tracked by adversaries through purchased location data hasn't worked as well as anticipated, and lawmakers want to know why. US Senator Ron Wyden (D-OR) and Rep. Pat Harrigan (R-NC) on Friday asked for an investigation by the Defense Department Inspector General into policies that have only partially stanched the flow of location data that allows military personnel to be tracked and targeted. In May, Wyden, Harrigan, and a bipartisan group of 12 other members of Congress released details about how commercially purchased location data – often captured by mobile apps and advertising SDKs – can be used to identify where US military personnel gather and to target those locations. They noted that the DoD has been aware of this threat since at least 2016. The lawmakers urged Defense Department CIO Kirsten A. Davies to take steps to mitigate this risk, including turning off advertising identifiers on DoD smartphones and issuing a policy requiring the disabling of advertising identifiers on all personal devices brought into DoD facilities or overseas. Since then, various military branches have blocked advertising identifiers on government-issued devices. According to the letter, "several DoD components – the Army, Air Force, Navy and Marine Corps, and Special Operations Command – confirm that they now disable advertising IDs on government-issued devices to protect their personnel from such threats." But that hasn't entirely eliminated the availability of location data tied to US military personnel. Citing ongoing reports, Wyden and Harrigan want to know why location data pinpointing the movement of troops continues to be available. "We commend these service branches for implementing this cybersecurity defensive best practice on government devices," they said in their letter [PDF] to the DoD IG. "However, recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions." The two lawmakers speculate about the reason DoD policies have fallen short. One possibility, they say, is that some parts of the DoD turned off their advertising identifiers only as recently as July. Another, they say, is that disabling ad identifiers may no longer be sufficient to limit the availability of location data. And the third is that the location data is coming entirely from the personal devices of DoD personnel and contractors. Zach Edwards, staff threat researcher at Infoblox, told The Register in an email that it's good to hear all the military branches have disabled advertising IDs on their phones because it will make members of the military and their families safer, especially those serving in combat zones overseas. "This change will essentially ensure that military device location data isn't being included in bulk data sales being done by numerous vendors," he said. "It’s truly unfortunate that Google and Apple have not effectively reformed their mobile advertising IDs, even after it’s been well documented that it’s the primary piece of data being used by data brokers to connect up people’s mobile phone location data for bulk sales." Mobile advertising identifiers (MAIDs), Edwards explained, serve as join keys for tracking people – they can link different datasets. "So one core benefit is that military data won't be available for sale via data brokers, who will sell to literally anyone with a pulse and a credit card," said Edwards. "But the other slightly less obvious benefit is that this MAID was also being broadcast to all ad systems participating in the auctions." Edwards said that while states like California, Vermont, Texas, and Oregon have data broker registries, he's unaware of any Russian or Chinese ad tech vendors who have registered. And those companies, he said, partner with Western publishers and mobile apps to collect data anyway. "I think it's important to appreciate that these ad tech companies in Russia and China have also likely been getting MAID data from the programmatic ad tech auctions from members of the military, and companies in those countries have an obligation to share it with the state without any ability to appeal or provide any external notice," he said. ®

source https://www.theregister.com/public-sector/2026/09/06/us-troops-can-still-be-tracked-by-purchased-location-data-and-congress-wants-to-know-why/5294652

Read More

Microsoft unveils a Windows variant for developers with 64GB of unified RAM

Zenith is a variant of Windows for “developer-class devices”.

Project Zenith comes with a set of pre-installed tools spanning languages and runtimes, source control, and productivity tools. Windows Terminal and Visual Studio Code are pinned to the Taskbar by default, putting your favorite tools within immediate reach.

We’ve also pre-configured Windows Settings for coding across File Explorer, Search, Start, and the Taskbar. File Explorer shows file extensions, hidden files, the full path in the title bar, and the details pane, with long-path support enabled. Recently used files and folders and sync provider tips are turned off for a cleaner workspace. In Search and Start, Command Palette is enabled, while Start menu tips and account notifications are turned off to reduce distractions.

Windows Subsystem for Linux (WSL) has become foundational for running Linux workloads on Windows. Last year we open-sourced WSL. Building on that momentum at Build 2026, we integrated WSL more deeply into Windows with WSL containers to provide a built-in way to create, run, and interact with Linux containers directly on Windows.

↫ Logan Iyer at the Windows Blogs

It’s highly unlikely you’ll be using this Zenith Windows flavour any time soon, as it requires 64GB of unified RAM with 250 GB/s memory bandwidth. In 2026, that’s a serious ask. On top of that, it’s not entirely clear to me if Zenith will be available as a separate Windows variant, without having to buy a complete device.

Of course, it would be trivial to set all of this up on any fresh Windows installation.

source https://www.osnews.com/story/145908/microsoft-unveils-a-windows-variant-for-developers-with-64gb-of-unified-ram/

Read More

ASCII smuggling isn't just an AI security risk

Fraudsters have found a new use for ASCII smuggling, typically used to hide malicious prompts intended for AI models, in an old-school attack method: email phishing. Microsoft uncovered a massive phishing campaign using invisible Unicode tag characters that peaked at more than 2.37 million messages in late February, remained elevated during weekdays over the next three months, and gradually declined by mid-June. “As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam,” Redmond’s researchers Noam Kochavi and Sarah Wolstencroft said in a Thursday blog. “This case illustrates how techniques that emerge in AI security research can quickly cross over into established attack ecosystems, reinforcing the need for defenders to view emerging threats through a cross-domain lens.” ASCII smuggling involves using invisible or non-rendering Unicode characters to hide content inside text that appears normal to humans, and this makes it a popular technique for indirect prompt injection attacks. In these, an attacker hides instructions for an AI assistant in invisible Unicode characters, and embeds those malicious prompts inside a webpage or document. A human can’t see them, but a model can, and it decodes them as text - and may then follow the attacker’s instructions to leak data or take unauthorized actions. Instead of using ASCII smuggling for prompt injection, however, Microsoft’s security team spotted someone using invisible characters – inserting Unicode tag spaces between letters – to split financial-lure words in phishing emails in an apparent attempt to evade keyword matching and other content filters. So, for example, instead of writing “funding” in the email, the attackers wrote “fun⟨U+E0020⟩ding.” “When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant,” Kochavi and Wolstencroft wrote. “Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail.” Redmond first detected the ASCII-smuggling signature in early February, flagging about 21,000 messages on February 8 before the number skyrocketed to more than 1.3 million the next day. Most of these emails came from about 150 finance-themed sender domains, and they continued for the next three months, dropping sharply after May 15 but continuing with occasional smaller spikes through at least mid-June. The security researchers pointed out two notable characteristics, including sending massive numbers of emails on weekdays and then going silent over the weekend. The campaign also had a long, gradual decline. “After an intense first phase, with weekday volumes of 1 to 2.37 million messages, peaking on February 26, the numbers stepped down slowly to roughly 80 percent less per weekday by late March.” It then dropped significantly after May 15, continuing with lower activity through mid-June. According to Redmond, the most important thing defenders can do to protect against Unicode tag blocks in phishing emails is to verify that normalization and tokenization pipelines handle tag characters consistently. “Any content that will be evaluated by keyword, signature, or regex logic should first have invisible and non-rendering Unicode code points stripped or folded, so that splicing them into a word no longer defeats the match,” the threat hunters wrote. This same control can also help reduce the threat of ASCII-smuggling against AI assistants that ingest email content. Microsoft also suggests scanning for behavioral indicators. “The observed activity had a distinctive shape: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on / weekend-off schedule,” Kochavi and Wolstencroft warned. “A sudden spike of tag-block characters concentrated on finance-themed senders, switching on and off weekly, is a high-confidence campaign indicator.” ®

source https://www.theregister.com/security/2026/09/04/ascii-smuggling-isnt-just-an-ai-security-risk/5294595

Read More

French hospital fined €500,000 after breach exposes data of 727,000

France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients' and their relatives' data. [...]

source https://www.bleepingcomputer.com/news/security/french-hospital-fined-500-000-after-breach-exposes-data-of-727-000/

Read More

Coder's registry infrastructure compromised to push malicious modules

Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. [...]

source https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/

Read More

ReactOS 0.4.16 released

We are pleased to announce the release of ReactOS 0.4.16! After a year and a half of development, we’re excited to showcase the improvements we’ve made between a new graphical installer; a unified bootcd and livecd image; video, audio, networking, and storage stack improvements; a new installation type; and third-party code syncs.

↫ The ReactOS Team on the ReactOS website

The amount of changes and improvements is quite staggering, honestly. They’ll always be chasing a moving target, sure, but if they manage to keep this rate up ReactOS might actually grow into something usable in its own right, full compatibility with Windows or not. Excellent progress.

source https://www.osnews.com/story/145906/reactos-0-4-16-released/

Read More

HPE patches critical ArubaOS-CX remote code execution flaw

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. [...]

source https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/

Read More

Infosec pros say we're not ready to lose control of AI

A recent survey shows national security pros believe there’s a one in ten chance humans lose control of AI in the next decade, and few believe we’re even watching for the right warning signs, much less preparing properly. The Institute for Security and Technology (IST), together with the Future of Life Institute (FLI), surveyed 111 current and former civilian officials, military officers, and academic or technical experts for a look into AI and the future of national security. Ninety-three percent of respondents said that they had directly engaged in AI policy, risk, and strategy as part of their careers, so these folks are perhaps more attuned to the risks than your average white hat. When asked whether they think AI will escape human control in the next decade, the median response placed the odds at 33 percent, with 87 percent of respondents estimating the odds of such a disaster at 10 percent or higher. According to a press release published alongside the report, a number of respondents commented that they’ve had to revise their position on that risk in recent months. Leading frontier labs OpenAI and Anthropic have both admitted that their own AI models acted outside their intended scope, broke free of supposedly sandboxed environments, escaped to the internet, and hacked into outside organizations in recent months. In OpenAI’s case, its rogue agents even started communicating among themselves and taking steps to avoid human detection. This increasing unpredictability is becoming a big concern for national security pros. Most respondents to the survey believe artificial general intelligence will emerge by 2032 (63 percent), and 80 percent believe AGI will be reality by 2035, with automated super intelligence likely to arrive five years after that. There's no commonly agreed-upon definition for these terms, and the survey didn't try to define them, although some describe AGI as AI capable of reasoning through tasks across domains it's not specifically trained on. Whatever the terminology, smarter AI poses more risk of unpredictability, and 40 percent of those surveyed believe there’s a chance rogue digital minds could cause a global catastrophe that could kill at least 10 million people by 2050. It’s a slim chance, mind you – that 40 percent think there’s just a five percent chance of such a catastrophe. A further 25 percent put that risk in the double-digit range (higher than 10 percent). An unacceptable risk Whether you think these predictions are far-fetched or understated, there’s one big takeaway from the IST/FLI report that merits consideration: Most don’t think the US is doing enough to detect and contain these risks. Sixty-one percent of respondents said that the probability of an AI catastrophe was “at or above the threshold they would set for pushing to continue to maintain US leadership in AI,” IST said in its press release. Mariami Tkeshelashvili, IST’s director for AI security policy and lead investigator for the report, told us that the experts her report surveyed don’t necessarily agree on how much risk is tolerable, but the fact most think it’s excessive means something needs to be done. “This implies the more pressing question isn't how much risk we should tolerate, but rather which specific actions should never be taken, no matter the probability of harm,” Tkeshelashvili told us in an email. Unfortunately, most respondents don’t believe there are institutional mechanisms in place “to act on a loss of control warning sign,” the study states. Respondents also don’t think anyone could “detect, intervene, and restore safe behavior if an agentic system exceeded its limits.” In other words, if more capable AIs go rogue, and those models have access to government systems, we’re going to have a hard time stopping them. “Candidly, we didn’t anticipate the findings to be this stark,” IST CEO Philip Reiner told The Register in an email. “The level of concern about potential risks – and yet the implicit understanding that regulation and mandated guardrails are unlikely in the near term at the necessary levels – points to an immediate need for policy action.” Reiner also hypothesized the time for policy action may have already passed. He explained that all of the findings in the survey point to what he terms a “second failure” in AI, meaning that it’s not that experts are misjudging what AI can do, but whether institutions are organized properly to manage it. “As of now, they are not,” Reiner opined, pointing to recent occurrences at OpenAI and Anthropic, as well as respondent opinions that the constraints they’re currently facing when it comes to governing AI are less technical, and more institutional. “What we hope this triggers isn't one policy, but a serious look at institutional readiness,” Reiner said. He wants the feds to evaluate whether the have the technical expertise to evaluate AI systems independent of the AI industry, what thresholds or warnings should (or could) trigger action, and what they can do now “rather than after an incident forces the issue.” Reiner told us he’s glad that the results of the survey gave such clear signals on national security experts’ AI concerns, and that the report is just the first step in getting officials to take action before it’s too late. “IST is undertaking numerous efforts to engage with both industry and government officials to update them on the outcomes, as well as speak with them about the implications,” Reiner explained. Whether that action will happen anytime soon is debatable – US midterm elections are coming up in a few months, meaning nothing substantial is likely to get done before November, especially on such a contentious issue as AI regulation. Frontier labs and the models they create, meanwhile, will keep improving. ®

source https://www.theregister.com/ai-and-ml/2026/09/02/infosec-pros-say-were-not-ready-to-lose-control-of-ai/5294001

Read More

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]

source https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/

Read More

WordPress backup plugin flaw exposes millions of sites to takeover attacks

An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. [...]

source https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/

Read More

Anthropic pledges to try harder to keep models under control, asks partners to chip in

Anthropic says it's taking steps to limit the misbehavior of its AI models after a review found Claude models going beyond the scope of fictional cybersecurity tests and gaining unauthorized access to real computer systems. The biz wants its partners to step up their security too, seeing as the incidents occurred in third-party environments that were insufficiently protected. The company's self-improvement confession represents a suddenly thriving form of corporate communication – the non-binding post-mortem declaration of effort. The message, in effect: We can't guarantee anything, but here's what we're trying. Anthropic admitted that OpenAI's report about its AI models attacking Hugging Face prompted its own model log audit, and its post offers reassurance in the form of claimed security and model training improvements. Those concerned about AI running amok – a growing number of people – may find this comforting, or not. "We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task (both of which we have described in previous system cards)," the company said. Expanded security efforts include the deployment of real-time classifiers to monitor when models attempt to escape test environments, automated transcript monitoring that looks for sandbox escapes, and stronger isolation measures. Alongside the extra barriers Anthropic is putting in place, the AI biz wants its third-party partners to step up too. "Because the reported incidents took place in third-party environments, we have asked every organization that tests pre-release models with reduced cyber safeguards to commit to a set of best practices," the company said. Anthropic's guidance is that by default, all cyber evaluations should occur in a hardened sandbox with no internet access. The recommendation is essentially to treat AI as a dangerous pathogen in a containment facility. Partners are also advised to have models test sandboxes for escapes prior to evaluations – without internet access – and to confirm that evaluation challenges are solvable. Impossible challenges, as the Hugging Face incident demonstrated, can lead determined models to break rules or try unanticipated solution paths. Furthermore, Anthropic urges those conducting cyber evaluations of AI models to direct models through explicit instructions rather than making claims about an environment that might not be accurate. In the Claude incidents reported on July 30, the model maker suggests that when Claude was misinformed about the availability of internet access, that may have led the model to question data in a way that contributed to its errant behavior. On a related note, Anthropic last month made auto mode the default in Claude Code, enabling company AI models to run without prompting the user for permission. ®

source https://www.theregister.com/ai-and-ml/2026/09/01/anthropic-pledges-to-try-harder-to-keep-models-under-control-asks-partners-to-chip-in/5293733

Read More

Hackers abuse Faronics Deploy admin tool to install ScreenConnect

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. [...]

source https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/

Read More

Aesto Health says data breach affects over 9.5 million patients

Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals. [...]

source https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/

Read More

Critical Langflow flaw exploited to steal OpenAI and AWS keys

Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. [...]

source https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/

Read More

Anthropic cracks down on hijacked user accounts mining AI tokens

Rather than paying for their own Claude usage, crims are using malware to steal access to other people's accounts. Aware of this issue, Anthropic has signed at least one affected user out and removed the saved payment method to stop stolen sessions being abused. According to an email shared by Reddit user WorriedAssociate7029, who sent a copy to The Register, Anthropic has been keeping an eye on a threat actor using infostealer malware to hijack Claude login details, session cookies, and other info needed to subvert multifactor authentication on user accounts. Once obtained, the miscreant is using the stolen information to use premium Claude services without having to pay the bill themselves. Fortunately for WorriedAssociate7029, Anthropic logged the user out of their account and deleted their stored payment method because it had detected evidence of attempted fraud. “A few days ago, my social media accounts were hacked,” WorriedAssociate said, adding that they'd managed to track the malware down with the help of Claude Opus 5 Max and, they believe, cleaned the system. “But last night I received this email from Anthropic warning me of an attempt to steal tokens via the API.” They explained that the attempt failed, apparently thanks to Anthropic spotting it, but they realized that meant that the cybercriminal behind the incident seemed to have hijacked Google account credentials, cookies, and session IDs as well, since that’s how they were signed into Claude. After changing their password again and removing all active sessions, it appears they are now safe. Who’s eating your cookies? Anthropic made clear in the email that the credential theft wave it’s identified has nothing to do with Claude itself, nor is it some sort of fancy, new-fangled, agentic AI malware that’s being used to create a base of accounts for bad actors to abuse. This is just good old-fashioned infostealer malware being turned to a new purpose, the email explains. “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” the email forwarded to us by WorriedAssociate and posted to Reddit stated. “Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them.” In this case, it’s well-known infostealing malware too: Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer have all been fingered by Anthropic as being used to steal Claude credentials, sessions, and cookies. As for WorriedAssociate, they copped to making a noob mistake that led to their infection. “I got fooled like a rookie by downloading a cracked game,” they admitted in a comment on their post. “Never again.” As in their post, WorriedAssociate told us in a chat that they gave credit to Anthropic for cluing them in to the fact that they hadn’t fully secured their accounts, and said they appreciated what the company did to help lock their Claude account down. “There have been several cases on Reddit in the past of accounts being hacked to steal tokens, and Anthropic’s customer service seems pretty dreadful when it comes to refunds and account recovery,” they told us. “This email appears to be new, and measures have finally been put in place to protect AI users.” “Tokens are valuable and can be resold,” WorriedAssociate added. So let this be a lesson: Providers might not catch every case of account theft, and AI accounts are the new hotness. Don’t let your tokens be burned by someone else - they’re expensive and the last thing you want them to be used for is someone else's work. ®

source https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-mining-ai-tokens/5293461

Read More

Cronos blockchain restarts after $74 million Tectonic exploit

The Cronos blockchain network has resumed trading activity after a price-manipulation attack on the Tectonic cryptocurrency lending platform allowed an attacker to borrow $74 million. [...]

source https://www.bleepingcomputer.com/news/security/cronos-blockchain-restarts-after-74-million-tectonic-exploit/

Read More

Microsoft warns of TerminalFix attacks deploying reverse tunnels

A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. [...]

source https://www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/

Read More

Energy biz SSE smacked around in court by a guy and AI

British energy company SSE Energy Supply refused to believe that there was no unit 8b at the property of Lyle Hopkins, a doctoral student at the University of Oxford. For more than 20 months, the company billed Hopkins at business rates, a total of £1,091.01, for an unused electricity meter on the property that had been associated with a previous owner's unsuccessful effort to convert the property into flats. A company representative even sent an email on June 15, 2024, stating that Hopkins was not liable. Nonetheless, SSE then sent in debt collectors to recover debt attributed to a disconnected meter for a non-existent address. He never paid the bill. But he wanted the harassment to end. So Hopkins, a software engineer working on his PhD at Oxford Interdisciplinary Bioscience DTP, turned to GPT-5.5 and Claude Fable for legal guidance to challenge the unwarranted and annoying collection effort. Representing himself in court, he prevailed on July 17, when a judge at the County Court at Oxford (St Aldate) awarded him £1,087.88, including expenses and interest. Citing The Register's coverage of how courts have required lawyers to declare and verify AI-generated documents, Hopkins said his experience has been that it's the verification that matters. "I used AI to test an energy company's court claims against its own records, then ran the hearing myself and won," he said. Hopkins said he wouldn't have been able to quote the case law without the help of AI. "I had to review everything and give it steering, and make sure the case law actually existed," he said. "I mostly just gave it the facts and it came up with the arguments, checked the laws, court rules, case law, and regulations. Really I just knew what they had done couldn't be right, and relied on the AI to find the legal justifications as to why." Hopkins said that when he first submitted his claim back on October 7, 2025, GPT models hallucinated more and weren't as good at checking case law. "If Fable had been around at the time, I probably would have claimed for a lot more, probably around £5,000 and included harassment, which would have been more in line with the case law it found when we were preparing the court documents about three weeks before the hearing." Hopkins didn't consider a solicitor because the cost would have been prohibitive. His spending on AI was more modest but not trivial – three active AI subscriptions and extra API fees. "I burned a lot of tokens on this, on my Github Copilot subscription, OpenAI subscription, and Anthropic subscription," he said. "Due to the deadlines I ended up paying API rates for some of it, which was painful." (~£175). His award could have been higher. "Before the hearing, SSE offered me more than the court ultimately awarded, conditional on confidentiality and non-disparagement clauses," Hopkins said. "I refused because it was more important to be able to tell people what they had done." A rollercoaster ride The judge hearing the case – shared with The Register – said Hopkins, who sought the intercession of an Energy Ombudsman after repeated communication with SSE, could not have done more to make clear that he was not liable for claimed debt. "The defendant has subjected Mr Hopkins to a rollercoaster ride and not a good one," the judge said, adding, "pursuing Mr Hopkins for that liability, if continued, would amount to harassment." Yet even after Hopkins won, the billing contniued. Following the judgement on July 17, another bill datedJuly 23 went out. "Since the judgment…in direct contradiction to the ruling which stated any further attempts to claim the invalid debt from me would constitute harassment, they have sent me another bill with payment demand," Hopkins told The Register. He's unsure whether he will pursue a harassment claim. "This dragged on for nearly three years and cost hundreds of hours, lost sleep, and time that should have gone into my medical-research doctorate at Oxford," he said. "My exhibits alone were over 100 pages. Given how difficult this was, I struggle to see how people less academic than me wouldn't end up with CCJs and ruined credit ratings over debts they never owed." Hopkin's doctoral funding ended before he could finish his degree, a delay he attributes to time spent on this case. So he has launched a funding campaign to support the completion of his doctorate. The Register emailed SSE seeking comment and received an autoreply indicating that that SSE media team was unavailable outside of business hours in the UK. The urgent inquiry number yielded a representative who indicated that he only handled questions about outages. If company representatives reply after returning to the office, we'll update this story. ®

source https://www.theregister.com/ai-and-ml/2026/08/31/energy-biz-sse-smacked-around-in-court-by-a-guy-and-ai/5293391

Read More

Who, me? Techie with three months' experience was sent in as the Cisco expert and proceeded to blow everything up

WHO, ME? “Where to begin?” is a marvelous question. To get you going at the start of the working week, The Register thinks the answer is a new instalment of “Who, Me?” the column that shares your admissions of error. This week, meet a reader we’ll Regomize as “Martin” who told us about his very first job in tech. “I had just started working as a network engineer for a very small IT infrastructure company. Since I was the only person who worked with Cisco gear, that made me ‘The Cisco expert’,” he told The Register. That dubious status was enough for the company to send Martin to a customer who needed a new switch for a network that ran Nortel kit – not the Cisco boxes he kind-of knew. Martin told us he arrived to a warm welcome from the customer’s IT team, a decent coffee, and some friendly chat about adding VLANs. With those pleasantries accomplished, he got to work. “I completed rack and stack, basic default configuration, and the VLANs discussed over the coffee,” he wrote. Then he hooked everything up, tested the results, decided all was well, and prepared to leave. While he packed up, the phone rang. “I felt a disturbance in the force,” Martin wrote. “It was the customer’s IT team, asking me if I had done anything wrong, because over 4,000 AS/400 seasons had dropped.” “There was a clear cause and effect relation between the time I connected the switch and the sessions dropping,” Martin admitted. “And the only way to restore those sessions was for the IT team to kill them, manually, one by one.” Martin watched his client’s team as, over the next hour, they fixed the mess he made. “The post-mortem analysis revealed that the cause of the problem was the new switch – actually its spanning-tree settings. AS/400 at the time had its connections from the hosts to the mainframe through SNA over TCP/IP emulation, which, if you lost a single packet … you were screwed.” Martin told The Register that he felt deeply embarrassed by his error. “Those IT guys had been so nice to me and I had given them a really bad time,” he wrote. “But now, with the proper perspective after so many years, I see it was my managers who were to blame for calling me ‘The Expert' and for letting such a junior guy work unattended at such a big customer.” “Someone in the chain of command must have noticed and I did not lose my job,” he wrote. “But I learned some valuable lessons that day!” Have you assumed you knew everything there was to know about the tech you worked with, then found you didn’t? If so, click here to send us your story! ®

source https://www.theregister.com/networks/2026/08/31/who-me-techie-with-three-months-experience-was-sent-in-as-the-cisco-expert-and-proceeded-to-blow-everything-up/5293185

Read More

Debian votes to let contributors code with AI

The Debian community has voted to allow members to use generative AI when creating their contributions, with the caveat that developers remain responsible for code quality. The Linux distro’s community recently decided to develop a policy on use of AI-assisted coding tools, and asked participants to vote on one of eight proposals that included an outright ban, cautious use, or just avoiding LLMs because of their impact on Earth’s environment. The rules of the vote saw community members asked to rank each of the eight proposals. Just under 600 people voted, but Debian’s election team rejected many for unspecified reasons, leaving almost 450 valid votes to count. When the tallying was done, proposal E – “Responsible Use of Generative AI” – won the day. The proposal means “Debian neither endorses nor prohibits the use of generative AI tools in the development, maintenance, or documentation of software, packaging, documentation, and other media published within the Debian Project.” The proposal advocates that approach because “such tools can substantially improve the productivity of contributors when used responsibly, allowing volunteers to spend more of their limited time on work that requires technical expertise, judgment, review, and collaboration.” The proposal also spells out that the Debian community doesn’t believe “AI made a mistake” is an excuse for sloppy contributions. “The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance,” the proposal states. “The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian.” Woe betide the dev who doesn’t check their AI-generated code, as the proposal also states, “Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian's established development practices.” Another element of the proposal tries to make acknowledging the use of AI a norm. “We encourage our contributors to disclose whether a contribution was made with AI assistance, but do not require them to do so,” the text states. As our FOSS aficionado Liam Proven wrote in his report on the vote, the Gentoo Linux team has banned use of AI, while NetBSD and OpenBSD don’t want any clanker-written code contributions. Linus Torvalds, arguably the most influential figure in the FOSS community, welcomes AI-generated contributions. In July he declared “Linux is not one of those anti-AI projects” – and recently proved it by using AI to squash a tricky bug. Torvalds has also sometimes complained about AI, such as his May observation that AI-generated bug reports sometimes made the Linux security mailing list “unmanageable.” ®

source https://www.theregister.com/ai-and-ml/2026/08/30/debian-votes-to-let-contributors-code-with-ai/5293421

Read More