Fireworks AI says its October breach was broader than initially disclosed, with attackers gaining access to customer account and billing information as well as some datasets, incomplete model weights and secrets. Notion, the popular productivity and note-taking app, disclosed that it was impacted in the breach but "fewer than 1% of Notion workspaces" were involved. "Upon analysis of the new data, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable," it said. "'Unattributable' means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results." The Hacker News reports: In a notice published on October 10, 2026, [Fireworks AI] said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized third-party to access environment variables used in evaluation jobs in a limited number of customer accounts. The activity was detected on October 6, 2026, at 9 a.m. PDT. [...] The latest bulletin from the company reveals that the scope of the breach may have been broader than previously thought. The company said attackers reached its development environment via an unnamed third-party cloud provider that hosted Fireworks research and development (R&D) machines on October 23, 2026. "On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact," it added. "As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use." The breach is said to have provided access to the following types of information: [Resource metadata; Billing information; and Model weights and datasets]. Fireworks AI said payment card numbers are not stored by the company and were not impacted by the security incident. It also said it's alerting customers whose data was impacted.

Read more of this story at Slashdot.

New York is launching a state-backed AI safety research center at Binghamton University that will independently study and test AI systems, develop safety and security techniques, and train researchers in responsible AI. "While the federal government fails to act, New York is leading the way on AI safety and holding big tech accountable," New York Gov. Kathy Hochul said. "The stakes are too high to simply take AI companies at their word." Politico reports: The center -- which is funded by a $30 million gift from Bloomberg co-founder Tom Secunda and a $25 million research investment from SUNY and New York state -- is set to launch before New York's major AI safety law, the RAISE Act, comes into effect on Jan. 1. That will require submissions of detailed safety frameworks from AI companies operating in New York State, which Hochul's office hopes will be scrutinized by researchers at the new center. "AI is opening up questions that scientists could not tackle before," said Secunda, who also serves as the board chair of Empire AI, a $500 million public-private partnership. "With Empire AI and researchers across New York, the Center can test systems independently and give public officials evidence they can use." Over 80 leading scientists and researchers on AI systems from across New York state will contribute to the effort, which will be run by the New York Center for AI Responsibility and Research at Binghamton University, according to details shared by Hochul's office. The initiative will be led by Jeannette Wing, the executive vice president for research at Columbia University, and Greg Morrisett, the vice provost of Cornell Tech. "We need new techniques that can be applied to this new kind of system with swarms of autonomous agents acting independently and without control. How can you first detect that they're going to do harm, and how can you prevent them from doing harm?" said Wing. "The beauty of what's being proposed is that this state is committing resources to really light this up."

Read more of this story at Slashdot.

An anonymous reader quotes a report from TechCrunch: Anthropic announced new workplace features on Tuesday, including Claude Meetings, which brings Claude into video calls to begin working on tasks while participants are still talking. The company also unveiled Claude Whiteboards and Claude Sheets. The launch of Anthropic's new productivity-focused features comes just a few weeks after OpenAI unveiled a series of workplace tools that allow users to collaborate with ChatGPT to do things like visualize company information and create presentations, as both companies compete to turn their products into office suites of sorts to take on Microsoft and Google. Meta is also joining the competition with its Muse AI agent, which can build mini-apps on the fly to help users complete specific tasks. Here's a summary of each of the offerings Anthropic announced today: Claude Meetings: Allows Claude to join video calls as a visible participant, take notes, answer questions, retrieve information from connected apps, and create plans, timelines, and action items in real time. Available in beta for Team and Enterprise plans, initially supporting Google Meet. Claude Whiteboards: A collaborative visual workspace where teams can brainstorm with Claude, organize ideas into timelines and plans, and turn their work into documents or slide decks. It also integrates with Claude Meetings to build whiteboards during conversations. Claude Sheets: Lets teams create and collaboratively edit spreadsheets with Claude, including budgets and trackers with multiple tabs, formulas, formatting, and dropdown menus. Claude can make changes directly in cells while explaining its edits. Anthropic also announced the general availability of Claude Data (formerly Claude Dashboards) that connects Claude to business systems like CRMs and data warehouses. "Users can ask questions, and Claude responds with dashboards, written data stories, or narrated videos," reports TechCrunch. Additionally, the company announced new interactive connectors that let users open Claude and work within third-party apps like Adobe, Atlassian, and HubSpot.

Read more of this story at Slashdot.

SpaceX has unveiled the Starlink Mini 2, equipping the company's smallest satellite internet terminal with a removable 71Wh battery and Wi-Fi 6. Preorders are opening to select U.S. customers for $999, which also includes a year of Roam Unlimited service. Shipments are expected to begin in mid-December. InterestingEngineering reports: The removable battery represents the biggest functional upgrade over the original Starlink Mini. Previously, users needed an external power source to operate the satellite terminal. That meant carrying additional equipment for camping trips, remote work, or extended journeys. Mini 2 addresses that limitation with a detachable 71 Wh battery pack. It weighs approximately 1.08 pounds (490 grams) and delivers up to 4.5 hours of connectivity. Owners can replace it with another charged battery when necessary. The battery also features LED indicators and its own USB-C charging port. SpaceX supports 60-watt USB-C Power Delivery charging for the pack. The retail kit includes a compatible 60-watt wall adapter and a three-meter USB-C cable. Users can also power the terminal through USB-C without relying on its battery. A physical power button replaces the original model's simpler plug-and-play arrangement. [...] SpaceX has also upgraded the wireless hardware from Wi-Fi 5 to Wi-Fi 6. The integrated router supports coverage across approximately 1,800 square feet (167 square meters). An IP67 rating provides additional protection against dust and water. Other hardware details include a foldable kickstand and a standard 1/4-inch-20 tripod mounting thread. The terminal also offers a 55-degree field of view for satellite acquisition.

Read more of this story at Slashdot.

Nintendo is hiring a digital archivist to help ensure the company's historical records are "preserved for future generations." The 12-month position is tasked with designing and implementing a "structured framework for organizing technical records, engineering documentation, source materials, and institutional knowledge related to legacy systems and platforms." Polygon reports: In the past, Nintendo has drawn criticism from the preservation community. In 2022, the Video Game History Foundation publicly criticized the company for announcing it would be closing the Wii U and 3DS eShops. The foundation released a statement saying that Nintendo's decision was "actively destructive to video game history." The statement also pointed out that Nintendo is part of the Entertainment Software Association, which funds lobbying that prevents a number of preservation efforts.

Read more of this story at Slashdot.

Blender 5.3 has been released with support for 3D Gaussian Splats, Nvidia DLSS 4.5 Ray Reconstruction and Vulkan as the default graphics backend on Linux. Phoronix reports: Blender now allows importing Gaussian Splats from PLY, SPZ, and glTF files. Also new to Blender 5.3 is NVIDIA DLSS 4.5 Ray Reconstruction support as a new denoiser. Blender 5.3 also brings support for NVIDIA RTX Spark devices. For the Cycles code in Blender 5.3 the Principled BSDF for shader nodes now supports dispersion. Another notable change with Blender 5.3 is the Vulkan back-end now being the default on Windows (except for Windows on ARM) and Linux systems. Vulkan 1.1 or newer is required and should deliver better performance than OpenGL.

Read more of this story at Slashdot.

Reddit is rolling out an AI-powered shopping feature called "Reddit Reviews" that summarizes user conversations about products and turns them into dedicated reviews. TechCrunch reports: Reddit's announcement points to its rules and its latest measures to combat automated abuse and spam, as well as its practice involving community moderators, as tools it will use to keep the reviews on the site legit. The Reddit Reviews feature itself taps into AI to organize the conversations people are having where they describe their product experiences. These posts will often see users discussing how a product works for them, or why it fails, or what the trade-offs are that someone should consider before buying. The company has been testing the product reviews feature since February, initially with U.S. users in areas like Electronics, Video Games, and Health & Beauty products. In September, Reddit expanded the test to include the Home & Garden and Fashion & Apparel categories as well. Now, the company says Reddit Reviews is rolling out to all U.S. users on iOS, Android, and web, with an initial selection focused on around 10,000 products. Over time, it will roll out to more categories and expand beyond the U.S. To use the feature, Reddit users can search for a product or category in the app's search bar or click on a highlighted product name they see in someone's comment. From there, the user is taken to a screen where important conversations are summarized under a "what people are saying" heading. This will also include a visual breakdown that shows how many of those comments are positive, negative, or mixed, and what sort of things people said they liked or disliked about the item.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Reuters: The European Union must rethink security to take into account challenges and risks posed by the growing power of major technology companies that go beyond traditional competition concerns, European Commission Executive Vice-President Teresa Ribera said on Monday. "We need to review and to deepen our concept of security, including cybersecurity," Ribera told reporters in Lisbon, arguing that testing and monitoring devices connected to critical infrastructure was no longer sufficient and that security means also ensuring that the Big Tech companies are "governed by democratic and transparent patterns." "We need to be quite quick in the deployment of these new approaches ... This is one of the most critical topics for security, for democracy, and for (our) values," she said.

Read more of this story at Slashdot.

Back in July AMD announced the EPYC 9006 "Venice" series at their Advancing AI event. Today they are announcing EPYC 9006 series Socket SP7 processor availability and with systems beginning to ship today from their OEM/ODM partners. With that we are also now allowed to begin sharing AMD EPYC 9006 performance benchmark figures. Back in July I expected EPYC 9006 to be a "grand slam" for performance... After hands-on with the 6th Gen EPYC processors, it's a grand slam alright -- out of this world.

In addition to the AMD EPYC 9996 256-core CPU benchmarks out today in that dual socket configuration for a combined 512 cores / 1024 threads flagship Zen 6C server configuration, also tested recently at Phoronix was the EPYC 9686F part. The AMD EPYC 9686F is their new high-frequency Zen 6 part that features 96 cores / 192 threads at a boost clock of 5.3GHz! When the AMD EPYC 9686F they originally disclosed a 5.0GHz boost clock but with how well their production silicon panned out and/or marketing reasons, it's actually now confirmed to be 5.3GHz in production.

This summer AMD acquired the company MEXT for their AI-powered predictive memory technology to make flash memory such as NVMe SSDs behave more like DRAM. AMD MEXT with EPYC servers allows for flash memory as DRAM tiering and uses a predictive AI engine for handling the tiering in an effective way. There is a Linux driver but this is one of the few offerings in the AMD space that isn't open-source as part of their typical open ecosystem approach...

During the AMD briefings for 6th Gen EPYC SP7 availability, they did already tease next-gen EPYC processors...

In addition to today's announcement of AMD EPYC 9006 SP7 availability, complete with reviews of the AMD EPYC 9996 256-core flagship and EPYC 9686F 96-core 5.3GHz part, AMD also announced the EPYC Embedded 9006 Series SP7 processors...

Blender 5.3 is out today as the newest stable release for this leading open-source 3D modeling software...

Backed by Samsung, Square Enix, and others, KORA Systems announced KORA OS today as a Linux distribution built for the age of "intelligent PCs"...

With the assistance of AI/LLMs, eight more security vulnerabilities were made public today for the X.Org Server. These issues also end up affecting the XWayland code too...

With one recent commit, the top(1) command on OpenBSD became quite a bit more useful. The commit adds a new -Q flag to show each process' use of the chroot(2), pledge(2) and unveil(2) facilities.

The commit message reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Klemens Nanni <kn () cvs ! openbsd ! org>
Date:       2026-11-05 17:54:16

CVSROOT:	/cvs
Module name:	src
Changes by:	kn@cvs.openbsd.org	2026/11/05 11:54:16

Modified files:
	usr.bin/top    : display.c machine.c machine.h top.1 top.c 

Log message:
add Q flag/key to show pledge/chroot/unveil usage

Read more…

In an announcement posted on social media, Damien Miller (djm@) writes,

OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.

If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.

This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.

We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.

Read more…

As previously reported, Ori Bernstein is working on GEFS, the "Good Enough File System" imported to OpenBSD, and his EuroBSDCon 2026 presentation was very well received. In fact, the video is among the most frequently played from the conference.

Now Ori has followed up with more evolved code that includes several important steps towards makin the new file system fit for general use. In a message to tech@, Ori writes:

List:       openbsd-tech
Subject:    Re: GEFS on OpenBSD: A very early preview
From:       ori () eigenstate ! org
Date:       2026-10-31 17:08:42

So, it's probably time for a few updates. First
off, thanks to Martijn, and everyone else who
tried it out and sent patches.

Everything is updated and rebased, and the diff
has been regenerated with all of the lastest.

Read more…

LibreSSL 4.4.0, 4.3.4 and 4.2.3 have been released.

From the release notes:

Read more…

In his message to the ports@ mailing list, Thomas Frohwein (thfr@) leads in,

In what might the most surprising port proposal of the year, I'm proud
to present a new port for wine.

talking not about the beverage, but the Windows Emulator that enables running binaries for that operating system on other systems.

Among the editors there is no one with enough recent Windows exposure to comment seriously on this, but we do vaguely remember that a port of this software existed back in the day.

So if this falls within the things you are interested in or actually need, we would encourage you to read the entire emulators/wine thread and the later supplement on new port: emulators/wine-extras: scripts for winetricks and wine-steam to keep up to date on developments.

Then, if you are able, please help the effort by testing the ports and reporting back.

Theo de Raadt (deraadt@) has committed to -current a (WIP) new utility for updating system databases:

CVSROOT:	/cvs
Module name:	src
Changes by:	deraadt@cvs.openbsd.org	2026/10/20 19:08:58

Added files:
	usr.sbin/dbupdate: Makefile dbupdate.8 dbupdate.sh 

Log message:
initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem
from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory.  We can't
do this nicely with syspatch(8) because it requires patches in sequence
so a new tool had to be written.  It is intentionally kept very simple
so that it can be studied because we intend to run this in root cron,
(the non-simple parts figure out quickly when not to update).
looked at by sthen beck lucas dgl

Read more…

The OpenBSD project has announced OpenBSD 8.0, its 61^st release.

The new release contains a number of significant improvements, including but certainly not limited to:

• OpenBSD/amd64 kernel virtual address space is now 512GB [See earlier report]
• Mitigation for AMD Zen-2 operation cache corruption added [See commit]
• OpenBSD now uses AES instructions (on amd64 and arm64 when available) to increase speed of swap encryption/decryption [See commit]
• The OpenBSD/loongson hardware platform has been retired [See earlier report]
• getexecpath(3) added [See commit]
• drm(4) has been updated to Linux 6.18.53
• vmm(4)/vmd(8) improvements:
  • files are now used to manage VM ownership [See earlier report]
  • multi-processor VMs are now supported [See earlier report]
• WPA3 support introduced [See earlier report]
• syslogd(8) privileged and non-privileged parts now separate binaries [See earlier report]
• qwz(4) driver for Qualcomm Technologies WCN7850 wireless network devices added [See commit]
• PF queues break the 4 Gbps barrier [See earlier report]
• httpd(8) and smtpd(8) are now randomly relinked at boot [See earlier report]
• httpd(8) has seen many improvements:
  • support for custom HTTP headers [See earlier reports]
  • header block/drop rules for request filtering [See earlier report]
  • improved default crypto methods for HTTPS [See earlier report]
  • cache control for static files [See commit]
• relayd(8) has received several improvements:
  • improved default crypto methods for HTTPS [See earlier report]
  • support for ECDSA keys and certificates was added [See earlier report]
  • filter rules gained support for Lua patterns(7) [See earlier report]
  • support for multiple resolvable addresses [See commit]
• rtrd(8), a RTR-To-Router protocol daemon, and its control program, rtrctl(8), were imported [See earlier report]
• acme-client(1) gained support for external account binding [See commit]
• Several improvements in OpenBGPD [See earlier reports]
• A number of incremental improvements in rpki-client(8) [See earlier reports]
• tmux(1) gained support for floating panes [See commit]
• LibreSSL 4.4.0 [See earlier reports]
• OpenSSH 10.6 [See earlier reports]
• llvm/clang(1)/lld(1) updated to version 22.1.6 [See earlier report]
• LLVM toolchain added to OpenBSD/sparc64 [See earlier report]
• compiler-rt, libunwind, libcxxabi, libcxx updated to version 22.1.8

In addition, this release offers a number of bug fixes and as well as numerous improvements in hardware support.

See the full changelog for more details of the changes made over this latest six month development cycle.

The Installation Guide details how to get the system up and running with a fresh install, while those who already run earlier releases should follow the Upgrade Guide, in most cases using sysupgrade(8).

Readers are encouraged to celebrate the new release by donating to the project to support further development of our favourite OS!

Version 0.130 of Game of Trees has been released (and the port updated).

Complete release notes are as follows:

Read more…

It’s a bad one, and it’s been in the code for a decade:

A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

“Oversized” means longer than 256 bytes. Details.

Slashdot thread. And another news article.

Two weeks ago, I attended the [un]prompted AI security conference in San Francisco. It was an excellent event: three days of very dense talks about all aspects of AI security. (My talk was about integrous AI, and I will post it when it is online.)

AI security can be divided into three broad topics. It’s important for researchers to understand which one they are working on. And it’s important for us as a community to work on them all. They are: security of AI, security with AI, and security from AI. [un]prompted had good talks about all three.

News story: “Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen.”

Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160 million years ago. The exceptionally rare fossils reveal a creature unlike anything previously known, potentially a predator of smaller squid-like animals and a surprising survivor of a supposedly vanished family.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This is fascinating:

The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening.

It works by looking at Doppler curves, which plot the way a plane’s sound changes as it passes overhead because of the Doppler effect. This is the same familiar Doppler effect that causes the frequency of a siren to rise as it approaches and then fall as it passes by and moves away. More generally, it’s the phenomenon whereby the frequency of a wave perceived by an observer changes when the observer and the source of the wave are moving in relation to one another.

[…]

It’s sound that’s relevant here, though, and specifically the sound of aeroplanes. Early in his video, Colsto brings up a map of the flights that were in the air at the time the video he’s tracing was recorded. Much of this information is publicly available. Aircraft equipped with Automatic Dependent Surveillance–Broadcast (ADS-B) transmit data about their position, velocity, and altitude, which flight-tracking services collect and make available to the public. While not every plane is tracked, the system provides an enormous amount of information about aircraft movements.

In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.

Here’s some demonstrations of this from Germany:

Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change.

In testing this hypothesis, we have identified a substantial number of vulnerabilities in the German legal system using LLMs. To our knowledge, none of these have been previously recorded. We share a selection of vulnerabilities below, and present potential exploits for each. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.

We believe that with cheap legal reasoning proliferating, AI systems could jeopardize the functioning of today’s legal systems. In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves.

Still in its early stages, but definitely something that’s coming.

A comment:

3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Yes. It is a new world out there.

Neat video:

The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This story is interesting:

One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.

Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go.

It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.

Sharing Linux release announcements is apparently a cybersecurity threat. Fortunately, Facebook’s keeping an eye on me to make sure that doesn't happen again.

Backed by Samsung, Square Enix, and others, KORA Systems announced KORA OS today as a Linux distribution built for the age of "intelligent PCs"…

With openSUSE Leap making use of the modern Agama installer developed by SUSE engineers, the rolling-release openSUSE Tumbleweed is now preparing to make the same transitioning in replacing the YaST Installer…

Blender 5.3 adds native Gaussian Splatting support, enables Vulkan by default on Linux, and improves rendering, animation, and video editing.

The KDE Project released KDE Plasma 6.8.3 today as the third maintenance update to the latest KDE Plasma 6.8 desktop environment series, with more bug fixes and various improvements.

With Fedora 45 having shipped last week, developers are turning more of their attention to Fedora 46 that will debut by the end of next April…

An early version has arrived with Firefox 160, letting you move a tab or a selected part of a page into its own mini window. Does that serve any purpose?

Samsung's Galaxy XR headset runs on Android XR by default with its own downstream kernel patches. A user leveraging AI with multiple LLMs has now drafted an initial set of patches getting the Galaxy XR headset working on the mainline kernel along with bringing up the Qualcomm Snapdragon XR2+ Gen 2 "Halliday" SoC that powers this VR/XR headset…