fidzu : computers

BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, "The PHP story feels like the cyber equivalent of an unexploded bomb -- I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet." Although no successful attacks have been confirmed, the AI-assisted discovery of long-hidden flaws has triggered a worldwide security scramble, with websites taken offline as a precaution and administrators racing to deploy patches before attackers can exploit the vulnerabilities. From the report: The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. [...] It was supposed to be kept quiet until everyone had a chance to fix their sites -- but the news was leaked. From that point the clock started ticking. As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. "There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out." But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success. "We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," Gina Neff, Professor of Responsible AI at Queen Mary University, told the Today Program on BBC Radio 4. "We have enormous capability to handle these risks."

Read more of this story at Slashdot.

22 Oct 2026 6:00pm GMT

Anthropic has launched Claude Duet, an AI agent aimed at professionals and small businesses that competes with Meta's Muse and OpenAI's Dots. Here's Anthropic's description of what it can do: Each morning, it sends you a short brief on the most important items across your connected apps. Throughout the day, it keeps tabs on those apps and messages you only when something needs your attention. You can also hand it tasks of all shapes -- from simple administrative tasks of scheduling meetings to more complex ones, such as building dashboards with dozens of tools, creating financial or sales forecasts, prototyping, and building web apps. The Verge reports: Claude Duet pulls in memory, skills, and connected apps from Claude, and it has a virtual machine with a browser that it can use for completing work. Before any big step, like sending a payment or deleting something, Claude Duet messages you for approval. Given that Duet may be taking action on sensitive information, it has a new "new dedicated classifier and safety system prompt" that are "designed to reject requests to share the strictest tier of information," such as credit card numbers. Anthropic says Claude Duet is currently an "early version" and that it "still might misread a thread or miscalibrate what's urgent." It's also not "as strong" at personal errands like booking tickets.

Read more of this story at Slashdot.

22 Oct 2026 5:00pm GMT

Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline. ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability. ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon. ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation. ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure. ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

Read more of this story at Slashdot.

22 Oct 2026 4:16pm GMT

Graybeards like me remember trying to painstakingly type source code from a magazine. This is a very accurate account of what a young computer user in 1986 needed to do to get a new game for the Commodore 64, complete with an immersive emulation. It's time to install an app! But here in 1986, we still call them "programs," not apps. So, you'll want to set aside some time to get started installing a program.

22 Oct 2026 6:55am GMT

Ex-FCC chairs say Brendan Carr aims to scare broadcasters into self-censorship.

21 Oct 2026 10:17pm GMT

Time-based a la carte charges come on top of the purchase price for the games themselves.

21 Oct 2026 10:06pm GMT

Survey of 2,018 IT heads at big firms points to a lack of leverage.

21 Oct 2026 9:48pm GMT

Early 2025, I wrote about how I think macOS' UNIX certification was basically a lie. It required so many convoluted and cumbersome changes to macOS that literally nobody applies to their system that it the certification had kind of become a farce. At the end of the article I wondered for how much longer Apple would be playing this little charade to hammer macOS through a meaningless UNIX-shaped hole, and it turns out the answer was "about 18 months". When you go to the Open Group's website and the list of certified UNIX operating systems, macOS is no longer listed. For the past few weeks, it was still listed if you drilled down specifically to the UNIX 03 certification, but that, too, has now been removed. Assuming macOS 27 doesn't return in the near future with a brand new certification, we can safely say that Apple got tired of paying a few employees to get its desktop operating system certified. With one more operating system gone from the list, there's now only one UNIX operating systems left: AIX. While the registry also lists HP-UX, z/OS, and UnixWare/OpenServer, those either only conform to really old UNIX certifications (from the '90s), or simply aren't developed anymore (HP sunset HP-UX at the end of last year). Only one operating system version conforms to the latest version of the certification, UNIX 07, and that's AIX 7.2 TL5 "and later", which possibly includes AIX 7.3, the most recent version of AIX. Not that any of this really matters.

20 Oct 2026 9:41pm GMT

Hot on the heels of Wine being ported to OpenBSD, we now have the release of OpenBSD 8.0. It adds hibernate support for arm64, switches the sparc64 toolchain to LLVM, and updates the DRM graphics drivers to Linux 6.18.53, which also adds support for Intel Arc A-Series (DG2/Alchemist) graphics cards. There's a whole bunch of improvements, fixes, and changes for RISC-V and ARM in general, of course, as well as to the various Wi-Fi drivers. On top of that, it also comes with new versions of OpenSSH and LibreSSL, as well as a massive list of other improvements and fixes. If you've never installed OpenBSD before, be sure to read this detailed guide to know what to do once everything's installed, while listening to the official release song, of course.

20 Oct 2026 5:50pm GMT