Microsoft has revealed pay-as-you-go pricing for Xbox Cloud Gaming, with introductory packages costing $3.99 for 10 hours, $7.99 for 25 hours, or $11.99 for 50 hours. Starting in November, Game Pass subscribers will receive only 5 to 15 included cloud-gaming hours depending on their tier and will have to buy additional time -- even to stream games they've already purchased. Gizmodo reports: Back in September, before these changes were announced, you paid full purchase price for a game that isn't in the Game Pass library on the assumption that you'd be able to play it via cloud streaming. Maybe your hardware doesn't meet the specs for this fancy new game. Maybe your gaming PC exploded/got stuck on a ship/had a component fail. Maybe you just want to be able to play it in bed on your laptop. Whatever. Now you find that in addition to the cost of the game you bought, you're going to be paying by the hour to play it once your monthly allotment of hours is up. If this is you, I expect you're not particularly amused. Thankfully, Microsoft notes that the playtime you purchase "remains available until it's used," so you won't have to worry about losing any unused time between gaming sessions.

Ukrainian drone strikes have damaged three major Yandex data centers as well as facilities serving Sberbank and VKontakte (the country's equivalent to Facebook), disrupting cloud services, banking, e-commerce, ride-hailing and other digital services across Russia. The attacks may deal a longer-lasting blow to Russia's AI ambitions: Yandex's affected facilities housed its three top-500 supercomputers, and experts say sanctions and shortages of high-end Nvidia chips could make repairs difficult or even take years. "This effectively sets Russia far behind in the AI race, "said Mikhail Klimarev, head of the Internet Protection Society activist group. Fortune reports: Data centers are the latest targets of aerial campaigns waged by both sides against each other's vital infrastructure. [...] Kyiv's attacks on Russian data centers closely followed Moscow's recent strikes on data centers in Ukraine, which disrupted the internet and TV broadcasts. On Oct. 8, Ukrainian drones hit a Yandex data center in Sasovo in the Ryazan region that houses two of the company's three supercomputers. A data center in Kaluga was hit a day later and the one in Vladimir was struck Oct. 11.

The data center and AI hub for Sberbank was hit Oct. 14 in Balakovo in the Saratov region, and four days later, Kyiv struck a data center in St. Petersburg serving VKontakte. While oil refineries and warehouses are easy prey, data centers are even softer targets -- massive buildings packed with servers and supporting power and cooling infrastructure. Lasting damage can result from a drone carrying a relatively light load of explosives.

[...] Ukraine has stored critical data on servers in allied European countries, helping limit the damage from Russian attacks. But Moscow's strict digital sovereignty policy requires all data storage at home, making it extremely vulnerable. "Because all the infrastructure and all the data is located inside Russia, it's relatively easier to take down," [said Nick Reiners, senior geotechnology analyst at Eurasia Group]. Klimarev predicted the data center attacks could encourage many top Russian companies to move data abroad, while the authorities could ease their efforts to tighten internet controls to minimize the damage.

An anonymous reader quotes a report from Ars Technica: Comcast reportedly plans significant job cuts in its cable division as the firm continues to lose residential broadband and TV customers. Comcast lost 144,000 residential broadband customers in Q3 2026, up from a 91,000-customer loss in the same quarter a year ago, the company said in its earnings report today. Comcast historically capitalized on a lack of competition for high-speed wired broadband. But now it faces stronger competition from fixed wireless providers and from fiber providers in parts of its cable territory. "Fixed wireless remains aggressive and continues to take share, while fiber construction remains elevated, with pockets of irrational pricing and promotional activity," Comcast co-CEO Mike Cavanagh said today in an earnings call.

Comcast CFO Jason Armstrong said "irrational pricing" from fiber operators includes $30 to $40 monthly broadband offers "in specific markets in the third quarter." He said $30 to $40 pricing is irrational because deploying fiber costs $1,500 or more per home, and is "getting more expensive with construction costs up as you get into more suburban and rural areas." "As we look at the return profile of that, to us, that is irrational competition," Armstrong said. While he didn't name any specific competitors, Verizon has been pitching FiOS fiber plans that start at $30 a month. Comcast's network is a mix of fiber and cable, and it offers fiber-to-the-home in only small portions of its cable territory.

Armstrong said more Comcast customers are leaving when they face "pricing transitions," apparently referring to the price hikes customers get when promotional offers expire. "We've been refining our offers and retention strategies to better manage these transitions and strengthen customer retention," he said. Cavanagh said that "satellite is not yet a material factor" in the competition Comcast faces, but that Comcast is focused on "anticipating emerging forms of competition and positioning our business to respond as the market evolves."

Physicists at Northwestern University have successfully trapped a single positron for an entire month, allowing researchers to study its quantum properties with unprecedented precision. "Further investigations using the trap might reveal the secret of why the world around us is made of matter and not antimatter, when things could have presumably gone either way," reports Scientific American. From the report: Every normal particle of matter has an antimatter counterpart with equal mass but opposite charge. To build their trap, physicists started with atoms of sodium 22, a radioactive isotope with a half-life of about two and a half years. When one of these atoms decays, it emits a positron -- the antimatter counterpart of the electron. "The big challenge is to persuade these positrons to slow down and then capture them," says Gerald Gabrielse, a physicist at Northwestern University, who oversaw the project. The team reported its achievement on Wednesday in Physical Review Letters (PDF).

The first step is to send the positrons through the crystal lattice of a sliver of cold tungsten. As the particles go pinballing through the material, they slow down and lose energy. "Every time they bang into something, there's a chance of annihilation, but it doesn't always happen," Gabrielse says. "If they make it to the end, they get popped out." Next, the physicists steer the positrons along a channel using electromagnetic fields. Eventually the particles end up in a vacuum, just three tenths of a degree Celsius above absolute zero, trapped by an electric field on top and bottom and a magnetic field on the sides. "If you want to hold on to antimatter, you have to hold it in a container without walls," Gabrielse says. This method allowed the researchers to isolate and study a solitary, lone positron for a monthâ"and could let them do so indefinitely.

The researchers intend to use their trap to make precise measurements of the positron's magnetic moment -- basically the strength and orientation of its magnetic field. To do this, they must determine two things: the energy needed to flip the direction of the positron's spin and the energy needed to make it jump from its ground state to its first excited state. Using a similar trap setup, Gabrielse and his team have already measured the magnetic moment of an electron to a precision of one part in 10 trillion. Taking the equivalent measurement for a positron will allow them to make a crucial comparison. "We're looking to see if they have an exactly opposite magnetic moment," Gabrielse says. That's the prediction of the Standard Model of particle physics. If the two have different values, however, this could help explain why our universe is made of matter instead of antimatter.

For the first time, the UN has declared that exceeding the Paris Agreement's 1.5C warming limit is "imminent and unavoidable." "We are now saying this window has closed, but we can open it again by making the overshoot as brief as possible," UN Environment Program Executive Director Inger Andersen said on a call with reporters. "This is about how to find a way back as shortly and as quickly as possible with as limited an overshoot as possible." CNN reports: Past reports have examined the distance between countries' emissions reduction commitments and what it would take to limit global warming to 1.5 C above preindustrial levels. However, this year's report redefines the gap. Instead, it examines new emissions overshoot scenarios, and what it would take to limit peak warming to just 1.7 to 1.8 degrees C before bringing temperatures back down to 1.5 C through emissions cuts and the use of carbon removal technologies.

The report makes clear that every additional fraction of a degree of warming above 1.5 C "raises the risk of irreversible changes including in ice sheets, permafrost carbon, ocean circulation, and coral systems, along with devastating human impacts." Each added fraction of a degree of warming can have an "immense" impact "as measured in terms of damage, cost and loss of lives," said climate scientist Michael Mann of the University of Pennsylvania. Mann was not involved in producing the UNEP report.

According to the UNEP, which is based in Nairobi, the lowest overshoot scenario would keep peak warming to between 1.7 and 1.8 degrees C and return global average temperatures to at or below 1.5 C by 2100. However, to follow such a pathway, global greenhouse gas emissions would need to be slashed by far more than anything currently on the table at the upcoming COP31 talks. This would require an 18% cut by 2030, 45% by 2035, and 69% by 2040, relative to 2025 levels.

Meeting this lowest-possible overshoot scenario would require a tripling of renewable electricity capacity by 2035, and dramatic cuts to fossil fuels, including the phaseout of coal by 2040, the report states. In addition, there would need to be a major scaling up of carbon removal technologies, which so far have not been proven to work at such a large scale. In stark contrast to these figures, the fulfillment of existing emissions reduction pledges would only yield a 5-to-8% emissions cut by 2030 and an 11-to-15% reduction by 2035, the report found. This would be associated with a peak warming of about 2.6 degrees C.

If countries simply follow their current policies, then warming could reach a peak of about 2.8 C. That estimate has increased since last year, in part because of the withdrawal of the United States from the Paris Agreement and retraction of its emissions reduction commitments, the report states. Even the scenario that assumes countries meet their existing reduction commitments, and nations with net-zero pledges succeed in fulfilling them, still brings warming to a peak of 2.1 C.

An anonymous reader quotes a report from Axios: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service. [...] This presents significant security risks: banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds. In other instances, some banks have tracked activity when agents -- programmed to fulfill requests or complete tasks on a user's behalf -- contact call centers or appear to take actions independent of user instructions, the people said.

Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The concerns are at the root of the decision by several banks to restrict third-party AI agent access, the people said. Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents. [...] Many banks are broadly not able to parse whether agent account activity is user-directed, sources said.

[...] On one hand, banks are best positioned to respond to the threats and opportunities of AI given their cash on hand and experience as critical infrastructure. But money isn't necessarily enough to solve this problem, one source said, because of how quickly the technology is developing and revealing new weaknesses in real time. Banks are investing in preventing worst-case scenarios, but they are also preparing for when those could happen, including with "day after" scenario planning that would allow them to quickly secure or restore customer access, sources said.

Google is funding one of the nation's largest "virtual power plants," paying homes and businesses indirectly to reduce electricity consumption during periods of peak demand so more grid capacity can be available for data centers. Under its expanded deal with Voltus, the program could provide up to 1,070 megawatts in the Mid-Atlantic PJM grid -- roughly the output of a large nuclear reactor. The New York Times reports: That electricity won't come from new power plants. Instead, Voltus will sign up homes and businesses and give them financial incentives to curb their usage when local power demand is high or the grid is strained. Many of these reductions could occur automatically, such as through smart thermostats that dial back air-conditioning during peak summer hours or batteries that can provide temporary on-site power.

Each of these tweaks frees up only a small amount of power on its own. But by aggregating them across thousands of businesses and homes, Voltus says it can reliably provide lots of extra capacity when it's most needed, and do so within a few years. While tech companies will likely ultimately need to build traditional power plants if they want to keep building large data centers, this approach could be a faster, cheaper and less-polluting option in the interim. "We really see virtual power plants as a critical short-term solution," said Ellen Zuckerman, head of energy market development for North and South America at Google. "It's a way to invest in our communities, really double down on our clean energy ambition, but also meet capacity at speed and scale."

joshuark shares a report from BleepingComputer: Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet.

Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP). "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," it said. "In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'"

After releasing the October 2026 Patch Tuesday Windows 11 cumulative updates, Microsoft marked the bug as resolved, but in a Tuesday update it said the issues weren't actually addressed and that a fix would ship later. "This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated," it said in a service alert sent to IT admins. "A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion." While Microsoft continues working on a permanent solution, it shared a temporary fix that requires affected customers to choose one of two VPN tunneling protocols to work around the issue.

The Browser Company is shutting down its Arc browser on December 22 and encouraging users to migrate to Dia, its newer AI-powered browser for Apple Silicon Macs and Windows 11 PCs. Thurrott reports: In the message explaining why it was sunsetting Arc, The Browser Company explained that maintaining two separate browsers was difficult to justify, especially from a security perspective. "Dia was built from the ground up to meet today's security standards, so that's where our engineering and security teams will focus moving forward," the company wrote.

The retirement of Arc will be gradual: While nothing changes for existing Arc users, it's no longer possible to create new Arc accounts as of today. On November 23, tab sync, Browse for Me, and other AI features will be disabled on the iOS and Android versions of Arc. Lastly, the desktop version of Arc will stop working on December 22, and Arc accounts will be deactivated.

Moderna shares plunged as much as 25% after partial clinical trial data leaked for its personalized cancer vaccine developed with Merck, despite the full results showing promising outcomes for melanoma patients. Analysts attribute the selloff largely to inflated investor expectations rather than disappointing clinical results. CNBC reports: The personalized vaccine, known as intismeran autogene, paired with Merck's immunotherapy Keytruda reduced the risk of recurrence or death in certain melanoma patients by 42% compared with Keytruda alone. The data also showed the shot along with Keytruda reduced the risk of cancer spreading to distant parts of the body or death by 38%, compared with just the immunotherapy. The companies say about 82% of patients who received the personalized cancer vaccine alongside Keytruda were alive without their melanoma returning at two years, compared with 70% of those who received Keytruda alone.

[...] Investors see the targeted vaccine as a possible breakthrough treatment, with the potential to be used in other forms of cancer in the future. It could also offer Moderna a critical additional commercial product in its pipeline, following vaccines for Covid-19, the flu and respiratory syncytial virus. "We assert this relative reduction in recurrence/death is clinically meaningful," said BMO Capital Markets analyst Evan Seigerman. "Such a reaction likely reflects inflated expectations into the full data release, rather than a true indictment on the efficacy of the combo therapy."

UBS analysts said "this is overall a strong data set" and gives more confidence in upcoming studies of the vaccine in kidney and bladder cancers. They added the stock reaction may be due more to massive expectations than disappointing data.

An anonymous reader quotes a report from Wired: Longtime audio giant Bose announced on Wednesday that it's acquiring Skullcandy, the lifestyle brand known for its bass-heavy headphones. Skullcandy will remain a separate company within Bose's Premium Consumer Audio business and will still be based in Park City, Utah.

The acquisition isn't out of left field. Bose has lent its audio expertise to Skullcandy over the past year under its Sound by Bose licensing program. Skullcandy designs the headphones and then works with Bose on the audio front. The relationship began with the Skullcandy Method 360 ANC earbuds in 2025 and more recently, with the Crusher 1080 ANC headphones in July.

[...] This is hardly Bose's first audio acquisition (though it may be the most mainstream). Bose acquired McIntosh Group, owners of luxury audio brands McIntosh Laboratory and Sonus Faber, back in 2024. But Bose seems to be after Skullcandy's connection to its community. "What does the brand stand for? Does it have meaning for consumers? Is it relevant to a group of consumers that, frankly, we otherwise aren't reaching?" Bose CEO Lila Snyder tells WIRED. "If you think about McIntosh, Sonus Faber, and Skullcandy, they all fit into that realm. Skullcandy gives us access to a customer base that we think we're largely missing with the Bose brand."

That's why Bose has no plans to relocate Skullcandy from Park City, Utah, which Snyder says is the epicenter of board sports culture. "We want to make sure we're right at the heart of it, as they always have been," she says. Skullcandy products are also affordable, especially compared to other Bose products and Bose-owned brands, which lets Bose compete at both ends of the market.

BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, "The PHP story feels like the cyber equivalent of an unexploded bomb -- I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet." Although no successful attacks have been confirmed, the AI-assisted discovery of long-hidden flaws has triggered a worldwide security scramble, with websites taken offline as a precaution and administrators racing to deploy patches before attackers can exploit the vulnerabilities. From the report: The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. [...] It was supposed to be kept quiet until everyone had a chance to fix their sites -- but the news was leaked. From that point the clock started ticking.

As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. "There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out."

But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success. "We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," Gina Neff, Professor of Responsible AI at Queen Mary University, told the Today Program on BBC Radio 4. "We have enormous capability to handle these risks."

Anthropic has launched Claude Duet, an AI agent aimed at professionals and small businesses that competes with Meta's Muse and OpenAI's Dots. Here's Anthropic's description of what it can do: Each morning, it sends you a short brief on the most important items across your connected apps. Throughout the day, it keeps tabs on those apps and messages you only when something needs your attention. You can also hand it tasks of all shapes -- from simple administrative tasks of scheduling meetings to more complex ones, such as building dashboards with dozens of tools, creating financial or sales forecasts, prototyping, and building web apps. The Verge reports: Claude Duet pulls in memory, skills, and connected apps from Claude, and it has a virtual machine with a browser that it can use for completing work. Before any big step, like sending a payment or deleting something, Claude Duet messages you for approval. Given that Duet may be taking action on sensitive information, it has a new "new dedicated classifier and safety system prompt" that are "designed to reject requests to share the strictest tier of information," such as credit card numbers.

Anthropic says Claude Duet is currently an "early version" and that it "still might misread a thread or miscalibrate what's urgent." It's also not "as strong" at personal errands like booking tickets.

Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

An anonymous reader quotes a report from the BBC: Google is facing a backlash from some staff members over the company's deployment of its AI technology for military use. The BBC has spoken to several tech workers who have either recently resigned from Google's AI company, Google DeepMind, or are in the process of leaving, over concerns with the tech firm's military contracts. Sofia Liguori, a London-based research engineer, is one of them. She resigned from Google DeepMind this week and spoke about her concerns exclusively with the BBC, despite her contract restricting her from doing so.

"Realizing my company is pushing more and more for AI systems in military operations makes me feel ashamed to work at Google," Liguori said, speaking in a personal capacity. [...] After working for the company for three years, Liguori said she decided to resign over Google's increasing work with the US and Israeli militaries. "I don't agree with this direction and this has led me to lose faith in my company being true to its stated ethical values," she said. Those values, according to Google's AI Principles, include implementing AI with "human oversight" and aligning the technology with "international law and human rights." But former and current staff at the company, and experts the BBC spoke to, said they were concerned about the level of human oversight at critical moments.

The tech workers said they are particularly worried about the AI military deals signed this year, because they greatly increase the scope of what the Pentagon can use the technology for. Andreas Kirsch, an AI researcher, also resigned from Google DeepMind earlier this month over his concerns. Kirsch told the BBC that he believes "Google's governance and oversight are not sufficient or meaningful enough to deploy AI safely and responsibly in military and classified settings" or "to develop artificial superintelligence safely in the future." "Google seems to have no right to control or veto how the Pentagon uses its AI and also seems to have limited visibility into how it's being deployed," he added.

[...] Employees at Google have told the BBC that staff are scared to speak out about AI safety and its uses in warfare because their employment contracts prohibit them from publicly criticizing the company. "In principle I'm not allowed to criticize Google for the duration of my life," Sofia Liguori told the BBC. But she decided to do so "because I believe it's important for these things to be known and I also think that talking about facts is not criticizing." Liguori added that at Google "people are scared of retaliation and putting their career at risk. You feel you are being watched, you can't speak."

A current employee at Google DeepMind, who declined to be named for fear of retaliation, told the BBC that "a lot of motivated employees who signed up for [the company's] original mission could leave -- but there's also a pipeline of people at the start of the careers who could fill those positions. It could be a changing of the guard." Another Google DeepMind staff member, who also wished to remain anonymous, told the BBC: "A lot of people have left the company that feel strongly about this [how Google DeepMind has changed its ethics position]." "Some people are putting up a fight, others are thinking: 'it's a big company. What do you expect to change?'", the employee said. In response, a Google spokesperson told the BBC: "We work with public sector organisations worldwide and follow a consistent process for reviewing and entering these contracts, including compliance with our acceptable use policies and AI principles."

"We also have dedicated channels for employees to safely raise any concerns -- ranging from business ethics to misconduct -- and have strict workplace policies in place to prevent retaliation of any kind."