Uber is launching Uber Parking, integrating technology from its SpotHero acquisition to let users find and reserve parking garages and lots directly through the Uber app. "You can also filter your results based on criteria like whether you want to self-park or use a valet, or other specific amenities," adds Engadget. From the report: To book a spot, you'll need to provide the make and model of your car and a license plate number. Depending on your lot, Uber will then provide a QR code or you'll be able to enter the garage through license plate recognition. If you need to cancel, the company says the majority of parking options can be canceled for free up to the start time. Parking reservations can also be extended through the app. Uber One subscribers get 10 percent back in Uber credits on eligible reservations. When it announced its acquisition, Uber said SpotHero offered garages and lots across more than 400 cities in the US and Canada, but the company isn't offering all of them at launch. For now, Uber says Uber Parking will be available in Chicago, Nashville, San Francisco, Atlanta, Austin, Boston, Dallas, Denver, Los Angeles, Miami, New York City, Philadelphia, San Diego, Seattle and Washington DC. The company also plans to experiment with using lots as a staging area for the autonomous vehicle fleets offered byÂUber's self-driving partners.

Read more of this story at Slashdot.

Boston Dynamics has equipped its Atlas humanoid with wheels, allowing the robot to rapidly roll across flat terrain while still using its articulated legs to navigate obstacles and uneven surfaces. "The 'experiment' combined classical model-based motor control with whole-body reinforcement learning to maintain dynamic stability across unstructured, real-world terrain," reports The Robot Report. From the report: In addition to learning how to move with wheels for feet, Atlas also performs pirouettes and various aggressive actuation maneuvers. This demonstrates that Atlas can smoothly switch between fast rolling on flat terrain and articulated legged motion over obstacles or irregular surfaces. [Andy Wu, controls engineer for Atlas at Boston Dynamics] trained the system in sim. The system learned all of the behaviors in sim and executed them in real life, with surprising accuracy, according to Wu. Wu said converting Atlas' locomotion style was "wonderfully simple." A single custom adapter mounts an off-the-shelf scooter rim onto Atlas' existing ankle actuator, and that's the only new part in the whole build. Because Atlas was designed from the start to be produced at high volume and to be easy to service, Wu said the retrofit was about as involved as swapping a wheel on a bicycle. The software side was just as straightforward, he said. Each wheel is modeled as an "ankle" that can spin continuously, so all Wu had to do was take the baseline robot model and swap the feet out for wheels. The next question that Wu intends to answer is the policy response to failed actuators. This is key to safety and to understanding how the system will respond to a system failure. The primary takeaway for Wu and the controls engineering team at Boston Dynamics is to understand control synergy. The video demonstrates that merging classical motor controls (for baseline stability) with whole-body RL (for reactive adaptation) yields superior real-world agility compared to using either method alone.

Read more of this story at Slashdot.

An anonymous reader quotes a report from NBC News: The Food and Drug Administration said Monday that GLP-1 drugmakers must add a warning label about a rare eye condition that can cause sudden blindness. The condition, called nonarteritic anterior ischemic optic neuropathy, or NAION, affects the optic nerve, which carries signals from the eye to the brain. When blood flow to the nerve is reduced or blocked, it can cause sudden vision loss. The condition is permanent with no known treatment. The FDA said "there is a potential increased risk of rare NAION" in people taking GLP-1 drugs. The agency's requirement applies to all GLP-1s, including Novo Nordisk's Ozempic and Wegovy and Eli Lilly's Mounjaro and Zepbound, as well as several older GLP-1 diabetes medications. [...] Previous research has found that GLP-1 use may increase the risk of NAION, and Lilly has said it was aware of studies on the potential link. The FDA said it began looking into a possible link after a 2024 study published in JAMA Ophthalmology that found diabetes patients prescribed semaglutide were four times as likely to develop NAION as those not prescribed the drug. The agency said it reviewed reports of side effects submitted to its adverse event monitoring system and analyzed data from multiple clinical trials. Cases of NAION have been reported for all currently marketed GLP-1 drugs, the FDA found. However, FDA scientists were not able to identify a mechanism for how the drugs could increase the risk of the eye condition. Risk factors for NAION can overlap with conditions seen in people taking GLP-1 drugs, including Type 2 diabetes, obesity, sleep apnea and hypertension. "Patients and caregivers should be aware of a potential increased risk of NAION, a rare condition that can result in acute, painless, decreased vision in one eye, including permanent vision loss," with GLP-1 use, the FDA said in the release.

Read more of this story at Slashdot.

Microsoft is testing a Windows 11 option that lets users permanently disable the Sticky Keys and Filter Keys activation prompts directly from the pop-ups themselves, ending a 31-year-old annoyance without requiring a trip into Settings. Windows Latest reports: Sadly, the dialog is still the same aging Win32 window, but we spotted Microsoft's design boss replying under an X post reply about this, saying he is working on modernizing legacy dialogs. The popup might be annoying, but did you know that it exists because of a pinball game from 1995? [...] The change is in Build 26340.9882 (Experimental) and Build 26320.9876 (Beta), both released on November 6 and based on Windows 11 version 26H2. Microsoft says you can "choose not to be asked again" from the Sticky Keys and Filter Keys dialogs, but it's a Controlled Feature Rollout in Experimental, so you may not see it yet.

Read more of this story at Slashdot.

President Donald Trump says the FBI is investigating Nvidia CEO Jensen Huang's affair with a woman alleged by U.S. intelligence to have gathered information for Beijing. "I know the FBI is looking into it in terms of something else, and I think that he'll be in good shape," Trump said at a White House briefing. The Associated Press reports: Trump suggested the extraordinary step of directly involving himself in a counterintelligence investigation, a sign of his friendly relationship with Huang and the possible geopolitical stakes. "I did speak to him today just to see if he's feeling all right, how you're doing," Trump said. "He said he had absolutely no idea that the person in question was a spy." Trump is slated to meet next week with Chinese leader Xi Jinping in Shenzhen, China, at the Asia-Pacific Economic Cooperation summit, but he was noncommittal about bringing up the situation with Xi. "No, I don't think so," Trump said. "I mean, maybe. I'm sure President XI will ask me about it. I just know Jensen very well. I just think he's a very honorable man." Nvidia has launched its own independent investigation into whether Huang was targeted by a foreign intelligence operation. Meanwhile, China has denied the allegations. "The so-called Chinese spy allegation is unsubstantiated. It is nothing but smears against China," Chinese Foreign Ministry spokesperson Guo Jiakun said during a regular news briefing Monday. Further reading: Commerce Dept. Chip Inquiry Was Halted After Nvidia Intervention

Read more of this story at Slashdot.

Epic Games says it plans to support its new Linux launcher on as many distributions as possible, specifically naming Fedora, SteamOS, CachyOS and Omarchy. GamingOnLinux's Liam Squires-Hand reports: Speaking to Jake Jones, Communications Director at Epic Games, they said: "Hey Liam! The new Epic Games Launcher is still in Preview and we plan to support as many Linux distributions as possible, including Fedora, SteamOS, Cachy, Omarchy, and more. We're testing and evaluating packaging formats for distribution, and we'll restore AppImage this month." With that in mind, until things settle down, you might see different packaging types appear or disappear until they decide firmly how they plan to support different distributions each with their own different packaging formats. Or, perhaps they might see the Flatpak light and just put it up officially on Flathub. Would make it even easier for SteamOS then too with Flathub, since it would just be a quick pop to Desktop Mode to install it directly in the Discover app.

Read more of this story at Slashdot.

France has accused Iran's Islamic Revolutionary Guard Corps of being behind last month's cyberattacks on fridges and freezers across the country. French Foreign Minister Jean-Noel Barrot said the attack was "unprecedented in both its scale and its level of aggression," adding those who were responsible would be hit with sanctions "at the European level." The BBC reports: The cyber-attack last month saw fridges and freezers in hundreds of supermarkets across France heated up, which spoilt fresh and frozen food estimated to be worth millions of euros. Then last week, dozens of supermarkets across several other European countries were also impacted by a cyber-attack that targeted fridges and freezers. It is not known if the instances are linked. Barrot said the attack on France's supermarkets "marks the first large-scale cyber-attack aimed at sabotage on our national territory, and it constitutes a major attack on the nation's interests and the security of the French people." He said the government had summoned the Iranian ambassador to Paris to "lodge a very strong protest against this extremely grave act." France will take "any other necessary and proportionate measures" to respond to the incident and "deter anyone who might seek to repeat it," Barrot added. Separately on Monday, the Paris prosecutor said an investigation had been opened into the head of an offensive cyber unit associated with Iran's Islamic Revolutionary Guard Corps (IRGC) as well as his two deputies. Laure Beccuau named the unit as Shahid Kaveh, which she said had an affiliation with the electronic and cyber centre of the IRGC. Shahid Kaveh is the name given to a cluster of hackers thought to be directly employed by the Iranian regime. [...] The French government has not said how it reached the conclusion that Iran was responsible, and attribution of cyber attacks is extremely hard as hackers are able to hide their locations.

Read more of this story at Slashdot.

Anthropic has released Claude Mythos 5.2 and Fable 5.2 with "improvements in areas like coding, reasoning, and vision," while cutting Fable's input price and claiming 30% faster responses. TechCrunch reports: It's Anthropic's first model release since the arrival of a third-party report from the assessment group METR, which suggested the lab might be approaching recursive self-improvement (RSI) -- or the ability for AI models to carry on model training independently. The METR report found internal models were speeding up Anthropic's AI progress by roughly 2x, although many uncertainties remain. Still, Anthropic's release notes significant ongoing challenges in accurately testing model capabilities. "Claude Mythos 5.2 and Fable 5.2 each voice suspicion that they are being evaluated more often than any of our recent models, which challenges our ability to assess how they will act in real-world settings. As these settings expand and capabilities increase with future models, we expect this challenge to grow." Anthropic maintains that the new version of Mythos does not have the ability to act covertly against its user, a verdict that's detailed further in Mythos 5.2's system card. "Claude Mythos 5.2 shows stronger covert capabilities than prior Claude models on several of our evaluations, particularly when its reasoning is hidden from the monitor," the system card reads. "That said, we believe that low levels of absolute performance on our new covert evaluations support claims that rely on detection of harmful actions in high-stakes situations." Fable 5.2 has been available to select parties in pre-release for some time, and Anthropic says the model has already "solved two open problems in theoretical physics, formalized Fermat's Last Theorem, and supported numerous other research projects."

Read more of this story at Slashdot.

With the assistance of AI/LLMs, eight more security vulnerabilities were made public today for the X.Org Server. These issues also end up affecting the XWayland code too...

Linux memory management expert Lorenzo Stoakes at Arm who has been contributing to the kernel since 2014 is stepping away from some reviewership roles within the Linux kernel due to all of the noise from the flood of kernel patches resulting fro AI/LLMs...

While there aren't any processors released yet with AI Compute Extensions (ACE) or AVX10.2 quite yet, the x86 Ecosystem Advisory Group led by AMD and Intel have now posted their ACE v2 and AVX10.3 specifications...

With openSUSE Leap making use of the modern Agama installer developed by SUSE engineers, the rolling-release openSUSE Tumbleweed is now preparing to make the same transitioning in replacing the YaST Installer...

With Fedora 45 having shipped last week, developers are turning more of their attention to Fedora 46 that will debut by the end of next April...

KDE Plasma 6.8.3 is out today as the newest bug-fix release for last month's major Plasma 6.8 debut...

The exfatprogs 1.4.4 release was issued today for these user-space open-source programs for managing exFAT file-systems on Linux...

Mesa 26.3 is out today as the fourth quarter Mesa3D feature release for this collection of open-source OpenGL and Vulkan drivers...

With one recent commit, the top(1) command on OpenBSD became quite a bit more useful. The commit adds a new -Q flag to show each process' use of the chroot(2), pledge(2) and unveil(2) facilities.

The commit message reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Klemens Nanni <kn () cvs ! openbsd ! org>
Date:       2026-11-05 17:54:16

CVSROOT:	/cvs
Module name:	src
Changes by:	kn@cvs.openbsd.org	2026/11/05 11:54:16

Modified files:
	usr.bin/top    : display.c machine.c machine.h top.1 top.c 

Log message:
add Q flag/key to show pledge/chroot/unveil usage

Read more…

In an announcement posted on social media, Damien Miller (djm@) writes,

OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.

If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.

This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.

We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.

Read more…

As previously reported, Ori Bernstein is working on GEFS, the "Good Enough File System" imported to OpenBSD, and his EuroBSDCon 2026 presentation was very well received. In fact, the video is among the most frequently played from the conference.

Now Ori has followed up with more evolved code that includes several important steps towards makin the new file system fit for general use. In a message to tech@, Ori writes:

List:       openbsd-tech
Subject:    Re: GEFS on OpenBSD: A very early preview
From:       ori () eigenstate ! org
Date:       2026-10-31 17:08:42

So, it's probably time for a few updates. First
off, thanks to Martijn, and everyone else who
tried it out and sent patches.

Everything is updated and rebased, and the diff
has been regenerated with all of the lastest.

Read more…

LibreSSL 4.4.0, 4.3.4 and 4.2.3 have been released.

From the release notes:

Read more…

In his message to the ports@ mailing list, Thomas Frohwein (thfr@) leads in,

In what might the most surprising port proposal of the year, I'm proud
to present a new port for wine.

talking not about the beverage, but the Windows Emulator that enables running binaries for that operating system on other systems.

Among the editors there is no one with enough recent Windows exposure to comment seriously on this, but we do vaguely remember that a port of this software existed back in the day.

So if this falls within the things you are interested in or actually need, we would encourage you to read the entire emulators/wine thread and the later supplement on new port: emulators/wine-extras: scripts for winetricks and wine-steam to keep up to date on developments.

Then, if you are able, please help the effort by testing the ports and reporting back.

Theo de Raadt (deraadt@) has committed to -current a (WIP) new utility for updating system databases:

CVSROOT:	/cvs
Module name:	src
Changes by:	deraadt@cvs.openbsd.org	2026/10/20 19:08:58

Added files:
	usr.sbin/dbupdate: Makefile dbupdate.8 dbupdate.sh 

Log message:
initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem
from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory.  We can't
do this nicely with syspatch(8) because it requires patches in sequence
so a new tool had to be written.  It is intentionally kept very simple
so that it can be studied because we intend to run this in root cron,
(the non-simple parts figure out quickly when not to update).
looked at by sthen beck lucas dgl

Read more…

The OpenBSD project has announced OpenBSD 8.0, its 61^st release.

The new release contains a number of significant improvements, including but certainly not limited to:

• OpenBSD/amd64 kernel virtual address space is now 512GB [See earlier report]
• Mitigation for AMD Zen-2 operation cache corruption added [See commit]
• OpenBSD now uses AES instructions (on amd64 and arm64 when available) to increase speed of swap encryption/decryption [See commit]
• The OpenBSD/loongson hardware platform has been retired [See earlier report]
• getexecpath(3) added [See commit]
• drm(4) has been updated to Linux 6.18.53
• vmm(4)/vmd(8) improvements:
  • files are now used to manage VM ownership [See earlier report]
  • multi-processor VMs are now supported [See earlier report]
• WPA3 support introduced [See earlier report]
• syslogd(8) privileged and non-privileged parts now separate binaries [See earlier report]
• qwz(4) driver for Qualcomm Technologies WCN7850 wireless network devices added [See commit]
• PF queues break the 4 Gbps barrier [See earlier report]
• httpd(8) and smtpd(8) are now randomly relinked at boot [See earlier report]
• httpd(8) has seen many improvements:
  • support for custom HTTP headers [See earlier reports]
  • header block/drop rules for request filtering [See earlier report]
  • improved default crypto methods for HTTPS [See earlier report]
  • cache control for static files [See commit]
• relayd(8) has received several improvements:
  • improved default crypto methods for HTTPS [See earlier report]
  • support for ECDSA keys and certificates was added [See earlier report]
  • filter rules gained support for Lua patterns(7) [See earlier report]
  • support for multiple resolvable addresses [See commit]
• rtrd(8), a RTR-To-Router protocol daemon, and its control program, rtrctl(8), were imported [See earlier report]
• acme-client(1) gained support for external account binding [See commit]
• Several improvements in OpenBGPD [See earlier reports]
• A number of incremental improvements in rpki-client(8) [See earlier reports]
• tmux(1) gained support for floating panes [See commit]
• LibreSSL 4.4.0 [See earlier reports]
• OpenSSH 10.6 [See earlier reports]
• llvm/clang(1)/lld(1) updated to version 22.1.6 [See earlier report]
• LLVM toolchain added to OpenBSD/sparc64 [See earlier report]
• compiler-rt, libunwind, libcxxabi, libcxx updated to version 22.1.8

In addition, this release offers a number of bug fixes and as well as numerous improvements in hardware support.

See the full changelog for more details of the changes made over this latest six month development cycle.

The Installation Guide details how to get the system up and running with a fresh install, while those who already run earlier releases should follow the Upgrade Guide, in most cases using sysupgrade(8).

Readers are encouraged to celebrate the new release by donating to the project to support further development of our favourite OS!

Version 0.130 of Game of Trees has been released (and the port updated).

Complete release notes are as follows:

Read more…

It’s a bad one, and it’s been in the code for a decade:

A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

“Oversized” means longer than 256 bytes. Details.

Slashdot thread. And another news article.

Two weeks ago, I attended the [un]prompted AI security conference in San Francisco. It was an excellent event: three days of very dense talks about all aspects of AI security. (My talk was about integrous AI, and I will post it when it is online.)

AI security can be divided into three broad topics. It’s important for researchers to understand which one they are working on. And it’s important for us as a community to work on them all. They are: security of AI, security with AI, and security from AI. [un]prompted had good talks about all three.

News story: “Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen.”

Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160 million years ago. The exceptionally rare fossils reveal a creature unlike anything previously known, potentially a predator of smaller squid-like animals and a surprising survivor of a supposedly vanished family.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This is fascinating:

The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening.

It works by looking at Doppler curves, which plot the way a plane’s sound changes as it passes overhead because of the Doppler effect. This is the same familiar Doppler effect that causes the frequency of a siren to rise as it approaches and then fall as it passes by and moves away. More generally, it’s the phenomenon whereby the frequency of a wave perceived by an observer changes when the observer and the source of the wave are moving in relation to one another.

[…]

It’s sound that’s relevant here, though, and specifically the sound of aeroplanes. Early in his video, Colsto brings up a map of the flights that were in the air at the time the video he’s tracing was recorded. Much of this information is publicly available. Aircraft equipped with Automatic Dependent Surveillance–Broadcast (ADS-B) transmit data about their position, velocity, and altitude, which flight-tracking services collect and make available to the public. While not every plane is tracked, the system provides an enormous amount of information about aircraft movements.

In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.

Here’s some demonstrations of this from Germany:

Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change.

In testing this hypothesis, we have identified a substantial number of vulnerabilities in the German legal system using LLMs. To our knowledge, none of these have been previously recorded. We share a selection of vulnerabilities below, and present potential exploits for each. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.

We believe that with cheap legal reasoning proliferating, AI systems could jeopardize the functioning of today’s legal systems. In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves.

Still in its early stages, but definitely something that’s coming.

A comment:

3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Yes. It is a new world out there.

Neat video:

The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This story is interesting:

One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.

Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go.

It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.

With Fedora 45 having shipped last week, developers are turning more of their attention to Fedora 46 that will debut by the end of next April…

An early version has arrived with Firefox 160, letting you move a tab or a selected part of a page into its own mini window. Does that serve any purpose?

Samsung's Galaxy XR headset runs on Android XR by default with its own downstream kernel patches. A user leveraging AI with multiple LLMs has now drafted an initial set of patches getting the Galaxy XR headset working on the mainline kernel along with bringing up the Qualcomm Snapdragon XR2+ Gen 2 "Halliday" SoC that powers this VR/XR headset…

It is a release that has taken a year to develop, with major changes like a Wayland session that is no longer experimental.

The Mesa 26.3 open-source graphics stack has been released today as the third major point update to the Mesa 26 series, introducing new features and improvements across most of the included graphics drivers.

The Firefox 160.0 release builds are now available as the latest bi-weekly stable update to Mozilla's web browser…

LibreOffice is free for business, but WPS Office's free edition has licensing limits. Compare the PDF, cloud, AI, and compatibility trade-offs.

Darling is the software project more than a decade in development that is designed to run macOS binaries on Linux. This macOS compatibility layer for Linux is now gaining more brisk developments as it turns to AI/LLMs to assist in this creation…