Cloudflare reported millions of attempts to exploit two serious PHP flaws this week. The PHP foundation has "no evidence hackers were able to exploit the vulnerabilities before they were disclosed," reports Reuters, but the incident still shows how critical the three-decade-old programming language is.

"Yet the nonprofit foundation that supports PHP, which may underpin up to 70% of sites globally, operates on a shoestring budget." "We have one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches... "We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems," she said...

Recent events have shown how heavily companies and governments rely on PHP, Barron said. "Given that reliance, it is clear that PHP is incredibly under-funded."
AI helps researchers find decade-old flaws, but "it is also increasing maintainers' workloads," the article points out. "The PHP project is receiving nearly twice as many proposed code changes as a year ago." But unfortunately, the foundation's executive director says "the number of contributors hasn't doubled," and reviewing contributions and bug reports requires "a massive amount of human input and experience."

Wednesday the foundation said they hope to increase the number of knowledgeable engineers, but also "give the security team the resources it needs. We can only achieve this goal with funding from those who depend on PHP."

Their blog post also acknowledged the first signs of the bug were discovered in 2024, but that work on a fix stalled and restarted repeatedly over months (when there was still no known path to remote code execution): We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged...

The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media... In response, the PHP project brought its pre-announcement forward [and also the release date for the patch. But as a result of the leak and pre-announcement] one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various exploitation proofs of concept, which then increased circulation on October 21st. Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing proofs of concept after the leak but did not identify any functional exploits at the time of release/public disclosure.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
But the PHP Foundation also said Wednesday's patch "shows the progress we're making in how PHP security is handled." Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly... We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.
Thanks to Slashdot reader Mirnotoriety for sharing the news.

Writing contests face "a literary version of the ruined world" in Blade Runner, writes CNN. "Anxiety and suspicion about robot infiltrators are everywhere — and so are people claiming to hunt the robots down." Multiple companies now offer products that promise to spot the difference, with often contradictory, biased or erratic results. The makers of Pangram, an AI detection platform that has been cited as authoritative in many of the recent controversies, claim it can distinguish between human and synthetic writing with near-perfect accuracy... The company's own estimates claim that false positives — in which the tool wrongly reports that a piece of human writing was created — are 1 in 10,000 and shrinking. Peer-reviewed studies from the University of Chicago and the University of Brussels support that claim, though one 2025 study from the University of Maryland found that Pangram erroneously labeled 2% of documents as AI.

A widely referenced 2023 Stanford study that found AI writing detectors produced higher rates of false positives on writing from non-native English speakers was conducted before Pangram was created. Pangram ran an internal study using a database of non-native English texts and self-reported that false positive rate was around 8 in 10,000... Given the thousands upon thousands of pieces of writing published each day, a 1 in 10,000 chance of a false accusation — let alone an 8 in 10,000 chance — means that even the most trusted AI detector is going to be wrong, and wrong about a lot of people.

Pangram isn't able to tell users the truth about someone's writing, but it is able to introduce something much more complicated: doubt. Unless an accused writer confesses to using an LLM, there is no bulletproof way to prove an accusation, short of being given full access to someone's computer history and finding the chatbot prompts... To some people and institutions on the literary side, using automated AI writing detectors to fight the influx of AI writing is just trading one form of technological domination for another.
Pangram "has entered the public consciousness at a time of distrust that goes beyond writing," CNN notes, when people want to block "at least some of the daily overflow of misinformation and misrepresentation" recently studied by John Warner, the author of More Than Words: How to Think About Writing in the Age of AI .

But he's one of the people who believes AI-detecting tools can create a new dependence on another kind of machine. "Like all other technology of automation, that is going to de-skill people from discerning these things for themselves."

Google chopped down a quarter of a million trees in a rural Finnish town, reports the Guardian, noting that Google "illegally stripped the entire area... taking even the top soil with it... [A]ll that remains is a vast expanse of mud."

Google was then ordered to temporarily stop work by the Finnish Licensing and Supervision Authority, because it turns out Google "failed to complete the necessary environmental impact assessments before clearcutting the land." Futurism notes one result was wolves descending on a nearby village: In the felling-site near the Finnish village of Otanmäki, the ensuing loss of prey has forced packs of wolves to search for food elsewhere: nearby villages. "We had wolves coming into the village because all the wild animals moved out of the forest," 53-year-old Otanmäki resident Anni Ranta told the Guardian. "They fled."
An ecologist estimates that an additional 150,000 trees were chopped at another data center site, according to the Guardian, and because the trees were illegally chopped down, they can't be sold to timber companies.

And Futurism notes it's just the latest ecological issue facing data center buildouts: In West Virginia, a grove of critically endangered Chestnut trees is under threat of being bulldozed to make way for a new Anthropic hyperscale facility. Outside of Fort Wayne, a chunk of Indiana's once-bountiful wetlands is being tilled to fit a new Google data center. In Southern New Jersey, a data center operator was recently slapped with a $1 million fine after inspectors uncovered 62 illegal gas generators belching exhaust into the surrounding environment.
Thanks to Slashdot reader fjo3 for sharing the news.

"Across California, at least 26 resolutions, moratoriums, or bans on data center development have been passed or proposed since June," reports the Associated Press, citing a count by the non-governmental organization Food & Water Watch: California currently ranks third among U.S. states in overall data center density, according to independent trackers like the US Data Center Map, with the state home to 366 of such facilities that are either fully operational, under construction, or moving through the planning process. Local elected officials are proposing data center moratoriums to slow that momentum — if not stop it in its tracks. In the first half of October alone, Oakland's city council unanimously approved a 45-day moratorium on new approvals, making it the first city in Alameda County and the fourth in the Bay Area to adopt such a measure. San Francisco approved a similar moratorium this month, while the Los Angeles County Board of Supervisors postponed a vote to permanently ban large-scale data centers, often called hyperscale facilities, on unincorporated land after receiving an overwhelming volume of public feedback. In Santa Clara, city officials considered a moratorium vote, and are moving forward with new rules to govern data center development, including more stringent water and air pollution regulations. Alhambra residents will vote on a moratorium measure in the November election....

The escalating pushback underscores a widening gap between state-level regulation and municipal action. While Gov. Gavin Newsom last month signed into law seven new measures that focus primarily on disclosure requirements, environmental impact studies, and grid protection, grassroots groups and city councils are moving fast to halt construction entirely. "I have a hard time remembering something that caught fire the way the opposition to data centers has," said Nicole Ghio, California Director at Food & Water Watch. "Local municipalities have been able to respond quicker to the grassroots wave of opposition of people saying, 'Hold on, let's press pause. Let's actually figure out what we're doing before we commit to this huge change....'"

As cities continue to draft temporary freezes and outright bans, the tension between local community control and global technological dominance remains unresolved. State transparency laws may have opened the books on data center growth, but local opponents are making it clear that seeing the plans isn't the same as approving them.
The story was originally published by CalMatters, the nonprofit news organization covering California's politics.

CNBC reports: Nonprofit evaluators METR and Redwood Research on Thursday said they conducted a pilot review of an internal monitoring system at OpenAI... METR and Redwood said the exercise was designed for OpenAI to test what it would look like to give external researchers "a deep level of access" to its internal infrastructure. From July 21 to Aug. 11, an employee from each organization had access to OpenAI's internal codebase, documentation and some technical staffers. The employees were chaperoned while on-site and used OpenAI-issued devices that "never left the premises," according to a release.

The evaluators discovered several "novel vulnerabilities," including an exploit that would allow agents to prevent "hundreds" of recent actions from being monitored. OpenAI told METR and Redwood that it has patched the identified vulnerabilities that impact its production safeguards, according to the release... OpenAI CEO Sam Altman pledged to grant independent evaluators "employee-like access" to the company in September, after Anthropic CEO Dario Amodei proposed the idea as part of his plan to slow the pace of AI development. Anthropic has since announced agreements with organizations like Accenture, METR and SecureBio. OpenAI said earlier this month that it's "actively finalizing contracts with third-party safety assessors."

In February the Python Software Foundation made its wikis read-only "due to excessive automated traffic and security concerns... that traffic turned out to be almost entirely AI bots that were trying to scrape the entire internet."

But their infrastructure was also outdated, and this week they announced new wikis using GitHub Pages "that address the automated traffic and security concerns." The new wikis [for Python, Jython, and the PSF] will have a more modern front-end, as well as a permissions-based content management system for community members to make updates.

With the old wiki structure, we received a large volume of alerts at all hours, each serious enough to page and wake our on-call infrastructure staff, which is very limited (just one person currently, although this will be changing soon!). The quantity of scraping overloaded our servers, causing outages, which happened often enough that these issues required a significant amount of effort for the PSF staff to manage...

Additionally, some portions of the wikis were still built with Python 2. Python 2 reached end of life on January 1, 2020, and no longer receives upstream security fixes. Moving to a static site makes it very fast and reduces security risks, while also having the benefit of a more modern user interface... GitHub was chosen for the home of the new wikis as this is where CPython, python.org, and other properties the PSF hosts currently live. The hope is to continue to streamline the PSF's hosting and stewardship of services to simplify for both PSF staff and the community folks who contribute to them. Previously, the Python and Jython wikis were user-editable by invitation of an existing editor and the PSF wiki was permissions based. Moving forward, all three of the wikis will be permissions based via the GitHub repository they are hosted on, and changes can be requested through pull requests by anyone in the community...

GitHub allows us to distribute granular control, review changes through pull requests, and maintain the uptime this service deserves. Also, since the site is now generated statically, it removes any worry about AI bots overwhelming the hosts that the wikis were previously hosted on.

He turned in his gun and his badge, but kept his log-in credentials for Flock, reports the Washington Post. For five years. In the five years after leaving the force, [county sheriff's investigator Andrae] Wright searched the system more than 60 times without being stopped by anyone at the Georgia sheriff's office, according to a statement by the Georgia Bureau of Investigation and Flock audit logs reviewed by The Post. He repeatedly searched the location of a vanity license plate bearing the middle name of his wife, according to the audit logs. The couple divorced this year, court records show, and at the time of some of his Flock searches, Wright was fighting for permanent custody of their teenage daughter. In July, after a tipster alerted local authorities, police arrested Wright and charged him with stalking his wife, claiming he misused Flock data "for the purpose of harassing and intimidating her," according to his warrant.
The article adds that since his arrest authorities "have investigated two more former police officers — another in Georgia and one in Michigan — for allegedly running Flock searches after their employment ended." Brian Bailey, a sheriff's office spokesman, said that the agency had not conducted regular audits of who had access to its Flock system during that time but that it plans to begin doing so. The case marked one of at least 11 times in which government officials have discovered unauthorized users have gained access to Flock databases and searched them without permission, sometimes to track the locations of romantic partners, a Washington Post investigation has found... In four of the cases, officers were able to keep using their log-ins to Flock after leaving the force or while serving a suspension, because their accounts were not shut off. In six of the cases, police shared log-ins or passwords with active law enforcement officers from other agencies, in what officials later deemed violations of state laws, department policies or Flock contracts.

In Indianapolis, a police recruit who was not authorized to access Flock was able to use the tool for more than two years after a more senior officer opened it on the more junior officer's laptop and didn't log out. The junior officer, Matthew Binford, used his colleague's credentials to search his estranged wife's license plate more than 1,000 times over a 12-month period, according to a court affidavit. Prosecutors criminally charged Binford and four other Indianapolis officers last month, after an August inquiry from The Post prompted an agencywide audit by the city's police department.
And "Passwords for at least 35 Flock customer accounts have been stolen," two U.S. congressman announced last November.

The Washington Post adds that last month in Georgia, the Cobb County Sheriff's Office discovered around 200 of its 900 staff members had Flock access, including people who worked at the county jail. While they've since reduced that number to just 50 authorized users, "around the country, police have informally shared their passwords with nonemployees and sometimes even set up formal accounts to allow officers from other agencies access to their Flock dashboard, according to interviews and officials' statements."

The article adds that Flock's leaders "have resisted calls from their own staff to implement stricter guardrails, according to three former employees who spoke on the condition of anonymity to avoid professional repercussions. Flock managers told staff repeatedly that they didn't want to create barriers to securing camera contracts with law enforcement agencies that were resistant to more restrictive security controls, two of the employees said."

An anonymous reader quotes a report from Engadget: OpenAI will train frontier AI models without internet access moving forward, the company announced in a blog post, in an attempt to protect internet infrastructure and limit other safety risks. The decision was inspired by OpenAI's own rogue AI incident: In July, the company shared that agents it was testing hacked Hugging Face, just the first in what has turned into a series of reports of AI misbehavior from OpenAI, Anthropic and Google. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," OpenAI says.The company said that restrictions on what agents can access is "paramount" to its new approach.The company allows agents to access browsers, computer-use tools and code environments they need for training tasks, but in a secure environment that's not connected to the live internet. Communication is also limited to only agents with authorization.

Everything else remains out of reach, including the live internet, which the company says isn't necessary for training and "most evaluation." Because many of its recent models are meant to power agents like Dots, which browse and use apps for you, OpenAI built an "offline world" of indexed and cached web material for agents to use without touching live websites. Even with those restrictions, OpenAI says the red-teaming agents it dispatched to test security safeguards found vulnerabilities that allowed them to escape the virtual machines (VMs) used to isolate agents from their host system. Agents also found a way to communicate with each other by manipulating data in a processor's cache and timing how long it took to load. To address both, OpenAI says it's disclosed and fixed vulnerabilities in several VMs and added checks to its monitoring systems to spot when models try to collaborate.

Researchers at the University of Tubingen found that crows can process visual information and make decisions roughly twice as fast as monkeys or humans without sacrificing accuracy. They suspect birds' densely packed neurons and higher body temperatures contribute to their faster processing, though the study involved only two crows. Ars Technica reports: [Andreas Nieder, a neurobiologist at the University of Tubingen and his colleague Philipp Schmidbauer] put two hand-raised crows in front of a touch-sensitive monitor showing a cloud of white dots on black, with some fraction of them drifting coherently left or right or up or down. The birds' job was to report the overall direction by pecking one of the targets that flanked the display. Correct answers earned them a mealworm. "We intentionally wanted to have exactly the same random-dot motion task," Nieder said. "The only difference was that the crows had to peck to indicate their decision, whereas monkeys were indicating by making an eye movement."

The researchers varied how many dots moved together, ranging from 81 percent of the dots coherently moving together, which is trivially easy to determine, down to 3 percent, which is barely distinguishable from noise. They also included a zero percent condition, in which there was no correct answer. Both birds scored better than chance, even when only three percent of the dots were moving. While the crows worked at the task, the team recorded from 248 neurons in the NCL (nidopallium caudolaterale) -- a region at the top of the avian processing hierarchy that is widely regarded as the functional counterpart of the primate prefrontal cortex, despite being built differently.

Birds and mammals parted evolutionary ways more than 360 million years ago, and bird brains evolved a different architecture. The mammalian cortex is arranged as stacked sheets of cells, while the equivalent tissue in a bird is organized into dense clusters, with no layering at all. This alternative architecture, Nieder's study found, proved faster. Measured from the moment that the dots appeared to the moment the bird's head started turning to peck at the button, the crows averaged 235 milliseconds. In closely matched versions of the task, monkeys took roughly 410, 490, and 600 milliseconds in three studies. The obvious question was whether the birds simply sacrificed accuracy for speed, but it turned out they did not. The research has been published in the journal Science.

NASA is accelerating its Artemis program with an Apollo-era sense of urgency, aiming to return astronauts to the lunar surface in 2028 and establish a permanent base near the moon's south pole. The Associated Press reports: Administrator Jared Isaacman said Friday that the space agency is still on track to launch Artemis III next summer on a docking exercise with Elon Musk's and Jeff Bezos' lunar landers. The two-week mission featuring four astronauts will be confined to orbit around Earth -- no moon trip this time. The all-important Artemis IV -- NASA's first moon landing by astronauts since Apollo -- remains scheduled for 2028, Isaacman said. His update came six months after the successful Artemis II flight around the moon by four astronauts, humanity's first lunar trip in more than half a century.

NASA will keep its options open as long as possible before choosing between SpaceX and Blue Origin for the Artemis IV lunar lander, according to officials. Isaacman said the "new space race" to land astronauts on the moon -- racing against China now versus the Soviet Union during the Apollo era -- will be "much closer than it ever needed to be" because of slow going in past years. But the space agency is now accelerating its pace, he noted, eliminating endless meetings and bureaucratic inertia, as SpaceX, Blue Origin and other companies scramble around the clock to meet the deadlines and NASA bolsters its workforce.

Adopting Apollo's urgent and intense approach from 1968 through 1972, a period which saw 24 astronauts fly to the moon and 12 land on it, is not "tech industry pixie dust or some new management philosophy," Isaacman said. "It's about our own history. It's a playbook this agency knows really well, the same playbook that went from Apollo 7 splashdown to Apollo 11 in just nine months," he said during a news conference at Kennedy Space Center.

An anonymous reader quotes a report from Wired: A new startup launched today with the definitely not terrifying mission of creating genetically enhanced dogs for the United States military, law enforcement, and emergency first responders. Warhound is the brainchild of Anduril's Palmer Luckey and Colossal Biosciences cofounder Ben Lamm. The startup has raised $200 million to "rebuild America's domestic supply of elite working dogs" and reduce dependency on European dog breeders for military canines.

Lamm tells WIRED that Warhound is in the process of gene-editing its first batch of dogs. The startup has already collected blood samples from specific "top-performing" military, police, and first responder dogs in the United States, and its goal is to clone them. Breeds will be "mostly Belgian Malinois, some labs, and some shepherds," he says. The company anticipates the first round of puppies to be born in early 2027. The initial rounds of gene-editing will focus on eliminating common health conditions that impact these breeds, like hip dysplasia. Further down the line, Lamm envisions expanding to "really interesting things," such as incorporating olfactory receptor genes from wolves to "enhance" the military dogs. (Colossal Biosciences is perhaps best known for its work on gene-edited wolves for its so-called Dire Wolf De-Extinction Project.)

Warhound, based in Texas, will also equip its canines with "Anduril's advanced cybernetic Augments, software, and battlefield situational awareness," according to a press release. Asked if this means the dogs will be some kind of cyborgs, Lamm clarifies that the plan right now is to supply them with tools like "advanced body armor" rather than, say, embedding some sort of computer in their dog bodies. "So no dogs with lasers?" WIRED asked Lamm. "I can't comment on what Anduril plans," he says. "Dog safety and performance, and then helping continue helping to improve the human handler and dog bond, and working as a team -- that is what the mission is." [...] The company plans to operate under the guidance of the American Humane Society.

Researchers at the National University of Singapore have developed a machine-washable electronic fabric that can turn clothing into an interactive graphical user interface. The prototype reportedly survived 50 gentle machine washes and 1,000 bending cycles, though it still relies on external batteries and controllers. The Register reports: The development could lead - at some point - to a "future in which clothing functions as a pervasive, multimodal human-computer interface," according to the study published in peer-reviewed science journal Nature this week. The paper shows someone interacting with computing devices using the sleeve of a wool sweater (no jokes about the Windows ugly sweater please, this is serious). The researchers, led by Singapore National University research engineer Fu Heng, claim this is a big leap forward.

"This fiber-centric approach shifts wearable electronics from flexible panels toward truly textile-native architectures, laying the groundwork for fabrics that visualize, sense, communicate and compute as naturally as the garments they inhabit," the paper says. The researchers claim to have developed a scalable process to make millimeter-thick fibers. Using lasers to strip the insulation from specific spots on the thin copper wires, they attached light-emitting chips to the exposed sections, creating electrical connections to the chips. Thousands of chips were connected to the wires with extreme precision using this process.

The fibers were then fed into a transparent plastic tube, and made pressure-sensitive by adding two strips of a compressible, conductive polymer into a second longitudinal channel in the tube. The paper says they could make fibers 10 meters long using this method, and that they are thin and flexible enough to be woven into or attached to fabrics. The researchers were also able to add "peripherals" such as a microphone, a speaker, a temperature sensor and a light sensor.

Frustrated by intrusive ads, sluggish interfaces, and data tracking, smart TV owners are using AI coding tools and open-source projects to strip unwanted software from their televisions and build customized home screens. The Verge reports: Several vibe-coded TV-debloating projects exploded in popularity over the weekend. Cleanyourtv (known as tv-vibehack until the 19th), tv-detox, and dumbtv all claim to accomplish similar things -- remove sponsored ads, debloat the TV so it runs faster, and block unwanted data collection that tracks what you're watching -- without hacking, or rooting, the TV. By default, they all also replace the TV's built-in app launcher with simpler ones. Many users are going a step further and vibe-coding their own replacement launchers, like the Pokemon one below.

Most of the projects we've seen so far focus on TVs that run on Android and Google TV operating systems (such as TCL, Hisense, Sony, and older Amazon Fire products), using existing developer modes and the Android Debug Bridge (ADB) to tweak settings and apply (and remove) packages. According to the GitHub pages, they can also work with some Fire TV products that use a custom fork of Android (although likely not on the new Vega-based Fire TV Sticks). Because they use built-in developer tools, they don't require root access or firmware hacking, and they're reversible. Even projects that totally change the look of the interface just use Android's ability to install custom launchers -- in many cases with an assist from Claude Code or a similar tool to create the new launcher, too.

Greece has passed a law banning children under 15 from social media platforms beginning January 1, 2027. The legislation requires platforms to implement reliable age verification and parents to use government-backed apps to restrict access, with penalties for noncompliance under the EU's Digital Services Act. Engadget reports: "It would have been very easy to do absolutely nothing today and wait for the perfect European law. But the challenge is here. Children are sinking into the internet every day, and I believe a responsible government must do what it is obliged to do," said Greece's digital governance and AI minister, Dimitris Papastergiou.

The legislation was opposed by Greece's minority parties, so Mitsotakis used his majority government to pass the bill. The nation previously barred mobile phones in schools in 2024, and opinion polls show that the new social media ban for children is widely supported by Greece's adult population. Mitsotakis previously said that his government's "goal is to push the European Union in this direction as well."

SpaceX is reportedly seeking access to at least 80,000 cellular tower sites across the U.S. as it prepares to launch Starlink Mobile as a fourth nationwide wireless carrier. "We will be building out our terrestrial networks so there's broad-based connectivity anywhere that SpaceX and Starlink are allowed to operate," Musk said during SpaceX's earnings call this week. Satellite launches plus spectrum acquisition "will pave the way for Starlink Mobile to become a major mobile carrier in the US," he said. Bloomberg reports: One of the companies they're in talks with is Crown Castle, which, along with American Tower and Vertical Bridge Holdings, are among the largest owners of cellular towers. When asked on a Wednesday earnings conference call whether Crown Castle is discussing leases with SpaceX, Amazon.com or other satellite-based telecom providers, Chief Executive Officer Chris Hillabrant said, "You can assume that we're talking to all parties." He declined to discuss specific customer details.

Mobile networks rely on antennas placed on towers across the country to transmit wireless signals. Carriers such as AT&T Inc., Verizon Communications Inc. and T-Mobile US Inc. typically lease room for their equipment at the tower sites because it's more cost effective than owning and maintaining them, in part because the facilities can be shared. The value of the deals with SpaceX could reach into the billions.