Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

An anonymous reader quotes a report from the BBC: Google is facing a backlash from some staff members over the company's deployment of its AI technology for military use. The BBC has spoken to several tech workers who have either recently resigned from Google's AI company, Google DeepMind, or are in the process of leaving, over concerns with the tech firm's military contracts. Sofia Liguori, a London-based research engineer, is one of them. She resigned from Google DeepMind this week and spoke about her concerns exclusively with the BBC, despite her contract restricting her from doing so.

"Realizing my company is pushing more and more for AI systems in military operations makes me feel ashamed to work at Google," Liguori said, speaking in a personal capacity. [...] After working for the company for three years, Liguori said she decided to resign over Google's increasing work with the US and Israeli militaries. "I don't agree with this direction and this has led me to lose faith in my company being true to its stated ethical values," she said. Those values, according to Google's AI Principles, include implementing AI with "human oversight" and aligning the technology with "international law and human rights." But former and current staff at the company, and experts the BBC spoke to, said they were concerned about the level of human oversight at critical moments.

The tech workers said they are particularly worried about the AI military deals signed this year, because they greatly increase the scope of what the Pentagon can use the technology for. Andreas Kirsch, an AI researcher, also resigned from Google DeepMind earlier this month over his concerns. Kirsch told the BBC that he believes "Google's governance and oversight are not sufficient or meaningful enough to deploy AI safely and responsibly in military and classified settings" or "to develop artificial superintelligence safely in the future." "Google seems to have no right to control or veto how the Pentagon uses its AI and also seems to have limited visibility into how it's being deployed," he added.

[...] Employees at Google have told the BBC that staff are scared to speak out about AI safety and its uses in warfare because their employment contracts prohibit them from publicly criticizing the company. "In principle I'm not allowed to criticize Google for the duration of my life," Sofia Liguori told the BBC. But she decided to do so "because I believe it's important for these things to be known and I also think that talking about facts is not criticizing." Liguori added that at Google "people are scared of retaliation and putting their career at risk. You feel you are being watched, you can't speak."

A current employee at Google DeepMind, who declined to be named for fear of retaliation, told the BBC that "a lot of motivated employees who signed up for [the company's] original mission could leave -- but there's also a pipeline of people at the start of the careers who could fill those positions. It could be a changing of the guard." Another Google DeepMind staff member, who also wished to remain anonymous, told the BBC: "A lot of people have left the company that feel strongly about this [how Google DeepMind has changed its ethics position]." "Some people are putting up a fight, others are thinking: 'it's a big company. What do you expect to change?'", the employee said. In response, a Google spokesperson told the BBC: "We work with public sector organisations worldwide and follow a consistent process for reviewing and entering these contracts, including compliance with our acceptable use policies and AI principles."

"We also have dedicated channels for employees to safely raise any concerns -- ranging from business ethics to misconduct -- and have strict workplace policies in place to prevent retaliation of any kind."

Airbnb is banning hosts from requiring guests to perform time-consuming checkout chores, including washing dishes, stripping beds, doing laundry, and taking trash off-site. The updated policy applies to reservations booked on or after November 20. The Verge reports: Airbnb is displaying hosts' requests more prominently now in a new "rules and requests" section on listings. You might see an "includes cleaning requests" warning if a host leaves chore requests in their listing after the new policy goes into effect. Hosts aren't allowed to sneak in extra rules in messages to guests or on signs around their property, either.

Some hosts pushed back on the house rules restrictions on Airbnb's forums, saying they pose health risks and arguing that guests can simply choose not to stay at listings with overly-strict rules. Airbnb says there can be exceptions to the limits on checkout chores, like asking guests to "dispose of trash in an animal-proof container in bear country."

Longtime Slashdot reader destinyland shares a report from CNN: The Pentagon has given the Department of Homeland Security permission to test a military-grade heat ray and develop tactics to potentially use it in operations at the southern US border, according to a memo signed by Defense Secretary Pete Hegseth last month and obtained by CNN. The heat ray, officially known as the Active Denial System, is a nonlethal weapon that shoots an invisible beam of electromagnetic waves that can reach a little more than half a mile away, according to the US military. The energy beam causes a burning sensation when it comes into contact with the human skin -- which Pentagon officials have previously compared to feeling a blast of heat when opening a hot oven. Military officials have said the resulting "tingling effect" lasts between 10 and 15 minutes but also generates "an instinctive and irresistible urge to run from the effect."

An anonymous reader quotes a report from The New York Times: For the first time, scientists say they have used viruses designed by artificial intelligence to treat a human patient. Researchers announced on Tuesday that they had administered the virus, known as a phage, to a patient suffering from a deadly bacterial infection. Phages attack bacteria, and the hope is that this one will kill the microbes causing the infection. Radical Numerics, the start-up that created the viruses, posted a technical report about them on its website. But the company declined to provide information about the patient or the doctors running the trial, citing confidentiality requirements.

[...] In 2025, researchers at the Arc Institute in Palo Alto, Calif., created an A.I. model called Evo 2, which they trained on millions of DNA sequences, including phage genes. They prompted Evo 2 to make new genomes similar to those in a group of phage species. The A.I. generated 700,000 virus genomes. The team synthesized DNA molecules from 285 genomes and inserted them into bacteria. The researchers found that 16 of the genomes gave rise to viable viruses. Three members of the Evo team, including Dr. Nguyen, left to found Radical Numerics. In June, the company unveiled a new A.I. model, called Omnii, based on some of the same principles as Evo.

Omnii can be trained not just on DNA but also on other aspects of biology, such as the structures of proteins and molecules that keep genes turned on or off. The company is now using Omnii to tackle a range of challenges, including designing cancer vaccines and recognizing the risk that a virus may cause a pandemic. Among these efforts is the first trial of A.I.-designed phage therapy. The researchers created variations of a phage called T7. The virus, which only infects E. coli, looks like a microscopic Apollo lunar lander: a ball-shaped protein shell that holds its DNA atop six leglike protrusions. To infect a bacterium, T7 lands on its surface, using its legs to anchor in place. It then injects its DNA into the cell.

Omnii generated new viral genes altering the shapes of T7's legs, according to Dr. Nguyen and his colleagues. While some of the new legs were significantly different from natural ones, Omnii's phages could still infect bacteria. Once the researchers were confident their strategy had worked, they partnered with doctors treating a patient with a stubborn E. coli infection. The bacteria had resisted not just antibiotics but all the available phages. The researchers said they had trained Omnii with information about the resistant strain and told it to design T7 phages with legs that could grab onto the bacteria. Once the A.I. generated genomes for new viruses, the scientists said they produced the corresponding DNA molecules and inserted them in bacteria. The bacteria became infected and produced T7 phages that could successfully infect, and kill, other microbes. After running tests to make sure the phages were safe, Radical Numerics presented them to the doctors. The F.D.A. authorized a trial. While the trial was authorized by the FDA, it's worth noting that the research has not yet been peer-reviewed in a scientific journal and there's no guarantee the AI-designed phages will work.

However, if it does prove successful, it could help speed phage therapy by cutting down the time it takes to create a new virus tailored to each patient's infection. "We think we can get it done in days," said Dr. Eric Nguyen, the chief executive officer of Radical Numerics.

eBay plans to cut about 1,000 jobs, or 9% of its workforce, as CEO Jamie Iannone moves to redirect resources toward the company's fastest-growing businesses. Reuters reports: The company had 12,300 employees at the end of last year. It also let go about 6% of its workforce, or 800 employees, in February as part of efforts to streamline operations. EBay has set itself apart from rivals by pushing into authenticated luxury goods, collectibles and refurbished products, which draw enthusiasts willing to pay more for valuable items. That has helped its shares rise nearly 40% this year, outperforming the benchmark S&P 500's around 12% gain.

"Our strategy is working," Iannone said in the memo, adding that "continuing to capture the significant opportunity ahead requires us to make thoughtful choices about where we focus and invest." He said affected staff would be informed in the coming days.

AMD has published Linux kernel patches for an official Ryzen overclocking driver that allows users to adjust CPU power and current limits through a firmware interface exposed via sysfs. Phoronix reports: AMD engineer Shyam Sundar S K posted the patches for the AMD Overclocking "AOD" WMI driver as an interface to the platform firmware for managing overclocking and power/current limits of modern Ryzen CPUs.

The driver in its initial form allows setting via sysfs a number of CPU tunables including the Package Power Tracking (PPT), Thermal Design Current (TDC), and Electrical Design Current (EDC) limits along with reading their supported range. SMT toggling can also be done via the interface as an alternative to the likes of Linux's "nosmt" option in disabling SMT at the platform level rather than kernel disabling. The current memory clocks can also be read via this AOD driver.

The power tunables aren't applied in real-time but go into effect at next reboot. The firmware does support many more commands compared to the few initially wired up and hopefully in time more of these controls will be enabled with this driver.

A CBC investigation found that more than 1.5 million Canadian Crime Stoppers tips spanning 25 years were exposed in a breach of the P3 Global Intel tip-management platform. About 850,000 records contained personally identifiable information, including addresses, phone numbers, emails, license plates and some banking details. Longtime Slashdot reader doconnor shares the report: The data was stolen last March by hacktivist collective Internet Yiff Machine. In a manifesto, the group said it wanted to disprove the claim by P3 Global Intel -- the company hired by Crime Stoppers to manage its tips -- that the platform was "anonymous" and "secure." A copy of the hacked data was made available to researchers and journalists, including CBC, by Distributed Denial of Secrets, a U.S. non-profit that archives and publishes hacked and leaked documents it deems to be in the public interest. The report found that more than 4,300 Crime Stoppers tipsters identified themselves by their full name, with hundreds of records containing staff warnings that individuals had "self-identified" or been "exposed," yet their information remained unredacted.

The leaked data included sensitive allegations involving murder, terrorism, drug trafficking and organized crime, with nearly 49,000 tips linked to cases cleared through arrests or criminal charges. Cybersecurity experts criticized the retention of decades-old records... "If a tip is closed, does that need to stay online?" asked cybersecurity expert Ben Coon. "The answer to that, to me, is no."

The RCMP was initially told Canadian data was unaffected, then assured that exposed Canadian records contained no personally identifiable information. This appears to contradict the CBC's findings. Furthermore, affected individuals have not been systematically notified because contacting them could further jeopardize their anonymity.

"For a system that has been designed to promise anonymity to the users, that has failed categorically," said Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph.

An anonymous reader quotes a report from Ars Technica: We haven't heard many details about Microsoft's upcoming "Project Helix" gaming hardware since the company announced it in March as a device that will "play your Xbox and PC games." In a new wide-ranging profile of Xbox CEO Asha Sharma, though, Fortune alludes to a dual release strategy for upcoming Microsoft gaming hardware, with "a next-generation handheld device" planned by the end of next year and a 2028 holiday season console release that could cost between $1,200 and $1,800.

That future console price range is based on what has "internally been projected" at the company, according to Fortune. But the price for consumers could come down if "Microsoft decides to subsidize the cost," the outlet says, as many console makers have done in the past. While a $1,200 starting price would be historically high for the game console market, even accounting for inflation, it also reflects a new normal: The slowdown in Moore's Law and AI-driven component shortages mean cutting-edge gaming hardware just isn't as cheap as it used to be. This year, the Steam Machine broke the $1,000 starting price, while the 2-year-old technology in the PlayStation 5 Pro is now going for $900, and the 6-year-old Xbox Series X now starts at $750.

A New Mexico judge has ordered Meta to pay $25 billion after a jury found Facebook liable for deceiving users about privacy during the Cambridge Analytica scandal. State Attorney General Raul Torrez called it "one of the largest, if not the single largest state verdict against a company in American history." While Meta plans to appeal the ruling, the funds that are to be collected will go toward state education spending. The Associated Press reports: Jurors in September found Meta liable for over 43 million violations of New Mexico consumer protection laws when a political consulting firm, Cambridge Analytica, harvested Facebook user data to generate targeted political ads for the 2016 election. Forty-eight other states settled with Facebook in a nationwide case, but New Mexico chose to take the social media company to court on its own. [...] During the trial, jurors assessed whether Facebook misled users about privacy and content moderation 34 separate times. State prosecutors, though, argued Facebook's statements deceived the entire population of New Mexico and extended beyond social media users.

In the end, jurors agreed with this premise and found Facebook liable for 2.1 million violations on certain counts, bringing the total number of violations to over 43 million. Facebook's attorneys have argued in subsequent court filings that the state's consumer protection laws don't apply to people in New Mexico who weren't using the platform at the time. [...] In one of the few wins for the defense, jurors found the state didn't prove that Facebook made false claims about removing harmful content, including misinformation about the COVID-19 pandemic.

The state said the company favored certain accounts and allowed for violent or inaccurate content to proliferate. Attorney Randi McGinn said in her closing argument for the state that Facebook profited off harmful content, which CEO Mark Zuckerberg denied during his video deposition. Zuckerberg said the company has to carefully balance freedom of speech with content moderation. Attorneys for Facebook said the company has adapted its policies since the state's lawsuit was filed in 2021 and that it removes 99% of content that violates standards.

OpenAI is bringing its models to Google Cloud's model garden and Antigravity coding tool, putting its technology on all three major U.S. cloud platforms after Microsoft's exclusive license ended earlier this year. "Google Cloud's longstanding investment in machine learning and AI has made it a destination for AI workloads and the developers and data scientists building them," OpenAI said in a blog post. It continues: [...] The integration will pair OpenAI's frontier models with Google Cloud's built-in access controls, centralized data governance, and high-performance infrastructure to support demanding enterprise workloads.

Google Cloud customers will be able to purchase OpenAI frontier models via model garden, transacted through the Google Cloud Marketplace. Enterprises with Google Cloud spend commitments will be able to draw down their GCP commitments for these purchases.

Additionally, OpenAI models will soon be available in Google Antigravity and the Gemini Agent, providing enterprise customers with model choice flexibility and the best model for each task. [...] For context, Microsoft previously held exclusive licensing rights to OpenAI's intellectual property, but that arrangement ended less than six months ago as OpenAI began expanding its partnerships with other cloud providers.

Just one day after Microsoft's exclusivity ended, Amazon announced plans to host OpenAI's models on its cloud platform in April.

"PHP disclosed two critical vulnerabilities in their programming language and urged web site operators to immediately apply the fix," writes longtime Slashdot reader smooth wombat. "As a result, government web sites in Europe and elsewhere temporarily went dark on Wednesday as operators worked to protect their systems." The Independent reports: Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X.

Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable. Special thanks to Slashdot readers Alain Williams and mrspoonsi for sharing this critical PHP security release.

For more details, read the official PHP announcement and guidance on what to do next.

An anonymous reader quotes a report from Ars Technica: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory stated. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.

Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they "expect mass attacks to start within 15 minutes of the release." A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Elon Musk says a merger between Tesla and SpaceX is under active consideration, with special committees at both companies evaluating a deal that could combine businesses valued at roughly $3.5 trillion. "Do I think it would be a good idea? Yes," Musk said during a call with financial analysts over the quarterly business results of SpaceX on Tuesday. The BBC reports: While Musk noted the certainty of such a merger should not be assumed, and it would need shareholders' support, he said special committees within both companies have been formed to examine the move. "The special committees have not reached agreement on terms of any transaction and there's no guarantee that they will," Musk added. "But I do think there is a lot of merit to merging and a lot to be gained."

[...] The company, which builds space rockets and Starlink internet satellites, is now expanding into offering cloud compute capacity for other tech companies, like Anthropic and Google. That line of business has become the most profitable part of SpaceX, bringing in $7.5bn according to the latest quarterly results (PDF). Starlink also tallied revenue of $5.2bn. SpaceX as a whole, however, is not profitable and has lost $1.1bn so far this year.

[...] Musk said on Tuesday a full merger between the two companies would make sense for the work each is doing around chips, artificial intelligence, software and more. He described himself as a "conflicted party" as the chief executive of Tesla and of SpaceX. Even commenting on the possibility of a merger between the two companies, Musk compared to "tap dancing through a minefield." He added a merger would ultimately be decided by shareholders. At least 50% of Tesla's shareholders would need to approve the merger, which Musk described as "quite a high hurdle to achieve."