The new stage will be powered by one BE-7 engine, which the company developed for use on its Blue Moon spacecraft, one of the two private vehicles that NASA selected to be crewed lunar landers for its Artemis program. (The other is SpaceX’s Starship.) Blue Moon landing missions won’t need to launch on GS3-equipped New Glenn rockets, according to Blue Origin. But the third stage “can support sustained operations around the moon,” the company wrote in today’s blog post. “By delivering significant payload mass directly to trans-lunar injection (TLI), GS3 enables faster transit times while preserving propellant for on-orbit operations.” And there’s already demand for such services: Blue Origin also announced today that a government customer (which it did not name) has booked a GS3 mission to cislunar (Earth-moon) space, with launch targeted for 2028.

And the company dropped yet more news today — that it’s working on a new first-stage engine, called Northstar. Like Blue Origin’s other booster engine, the BE-4, Northstar burns liquid oxygen and liquid methane propellant, a combination known as methalox. But the new engine is more powerful and less complex. “Compared to the BE-4 engine, Northstar reduces mass by 30% and parts count by 50%, while increasing thrust from 640,000 to 715,000 pounds-force,” Blue Origin said in a second blog post today. “Manufacturing advancements have also significantly shortened production timelines, enabling assembly in less than a day.” Northstar went from program approval to development testing in just 11 months, according to the company. But today’s update did not say when the new engine will fly for the first time.

They’ll be replaced by a more modern system called Enterprise — Information Display System (E-IDS), which is comprised of a digital display for relaying status information, updates and other alerts to air traffic teams. The FAA plans to have E-IDS installed in 435 sites by the end of 2028; the first five locations to receive the upgrades are the Atlantic City International Airport, Nashville International Airport and Greater Rochester International Airport, as well as data processing hubs in Atlanta and Salt Lake City.

The Great Pacific Garbage Patch, an area in the Pacific Ocean where debris naturally accumulates, is full of tiny bits of plastic — so full, in fact, that it seems to be changing the color of the ocean. […] To better understand how microplastics may have influenced the ocean’s color, [Daniel Koestner, a postdoctoral fellow at the University of Bergen in Norway] and his colleagues looked at 20 years of satellite data from the spot in the ocean with perhaps the most of plastic — the Great Pacific Garbage Patch, a zone between Hawaii and California where trash trapped by ocean currents accumulates.

Between 2002 and 2022, the researchers found, waters near the garbage patch have gotten brighter in both blue and green wavelengths compared with surrounding areas. The results, published in the journal Communications Earth & Environment on Thursday, don’t yet prove that microplastics have directly brightened the ocean, the researchers emphasize, though their findings are backed up by lab experiments with microplastics. But without taking direct ocean samples, it’s hard to know for sure what’s causing the ocean’s color to change.

Applebee’s has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher found a password for an internal database inside Applebee’s mobile app, TechCrunch has learned. The popular restaurant chain confirmed [last Thursday] that it had taken action to address the security issue to prevent any unauthorized access to its customer database. […] The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes. The data also included veteran status, the number of times customers had logged in, when their accounts were created, and the IP addresses of their most recent log-ins, which can be used to reveal the person’s approximate location.

[…] When asked by TechCrunch, the spokesperson would not say if the company has server logs that it can review to determine whether anyone accessed the database, or if it has any logs at all. “Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added. It’s unclear how many customers were affected by the data exposure. […] Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year, though the company would not provide a number of how many customers had their personal information exposed by this security flaw.

Every future compute campus OpenAI owns and operates will have its own local compact. We’ll engage residents early enough to ensure their input shapes project plans, give them a local point of contact throughout the life of the campus, and report publicly each year on how we’re doing. Each compact will reflect local priorities and include a common set of commitments:

- Pay our own way on energy and infrastructure. We’ll pay the full cost of the electricity we use and the infrastructure needed to serve us. Before major spending begins, we’ll provide financial assurances so other customers are protected if a project is delayed, reduced, or canceled.
- Protect local resources and report on our impact. We’ll develop a water plan for each campus, prioritize closed-loop or low-water cooling, and publish site-level water and electricity use. We’ll publish construction plans and independent noise studies before operations begin and annually afterward. And we will not use non-disclosure agreements (NDAs) with public officials, allowing only narrow protections covering legitimate security information, trade secrets, or proprietary or competitively sensitive information.
- Create opportunities for local workers and businesses. We’ll publish the jobs we expect to create, work with unions and training providers to help residents prepare for them, and report annually on hiring and apprenticeships. We’ll also make sustained investments in priorities residents help select.

[…] The investments that help America compete globally can also help communities prosper locally. That starts with giving residents a say while plans can still change and a way to hold developers accountable for delivering on their commitments. That’s what we’re committing to at the campuses we own and operate, and what we believe people should be able to count on wherever AI infrastructure is built across the country.

Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library. Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because this is not a valid password hash, no password should allow access to those accounts. However, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes.

To prevent attackers from identifying valid usernames through different response times, OpenSSH was modified to perform password hashing even when an account had no usable password hash, including accounts configured with * to block password logins. The problem is that the musl C library’s crypt() function also returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit. This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account’s stored *, resulting in a successful login.

To be clear, the flaw does not allow attackers to bypass passwords on accounts with valid password hashes. […] Admins who can’t immediately install the update can mitigate the issue by turning off SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH. Kultekin says admins can also check for signs of exploitation by examining SSH authentication logs for password-based logins for accounts that should not allow them.

Engineers at Apple have the largest budgets because using AI for coding can consume a large number of tokens. Apple lets employees use Claude, ChatGPT, Gemini, and other models. Some Apple employees told Bloomberg that few were using their full $300 daily limit, so the savings may be small. Apple has also hired outside productivity consultants for some divisions. Combined with the AI cost cuts, the reviews have fueled worries about possible restructuring.

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.

The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016. […] Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network.

Vishnevskiy also shared an image of the Discord Windows client using just 290MB of RAM, which is a clear improvement as you only have to participate in a few servers and RAM usage can easily hit 1GB or more using the current Windows app. It’s not clear when Discord will make the full switch over to Rust, but Vishnevskiy says the company “hope to get it into testing with users soon.”

Soon after winning its banking license in 2023, Ueno seemed to be everywhere in Paraguay. The digital lender, a rebranded version of a decades-old finance company, lured customers with generous cash-back offers on groceries, grew to more than 70 locations, sponsored Paraguay’s national soccer team and plastered its name on the country’s main stadium. Government money poured into Ueno’s coffers under Pena. He also appointed Carlos Carvallo, president of Financiera Ueno, the predecessor to Ueno Bank, to run the central bank, the agency charged with supervising the digital lender. As of last month, Ueno reported holding roughly $800 million in public deposits, about a quarter of its total, including money from the state pension and health fund and the operators of Paraguay’s giant hydroelectric dams.

Even as retirees’ savings and other public money piled up at Ueno, worries were escalating inside the central bank. In June, its inspectors found a pattern of risky lending to insiders, reported ABC Color, a leading Paraguayan newspaper. Ueno had extended large sums to companies tied to its owners, beyond what the law allows and without enough collateral to cover the debts if they went bad. On a single day in September 2025, nearly $39 million had gone to three such companies. Pena repeatedly brushed off the warnings. As recently as last month, he defended Ueno and the central bank’s oversight, dismissing the concerns as a smear campaign that was spooking the public.

But on Monday, it all came crashing down. Regulators investigating Ueno’s loans to companies linked to its owners found poorly documented lending, the central bank said, as well as expenses the bank had wrongly counted as assets. Once the books were corrected, Ueno’s capital, the cushion banks must keep to absorb losses, fell to less than half the legal minimum. The central bank seized the lender Tuesday and announced plans to move customers’ accounts, along with whatever assets still hold value, to other banks before liquidating what’s left. Ueno’s app, cards and transfers went dark and its branches locked their doors, leaving desperate depositors lined up outside with no way to cash out their savings. On Wednesday, a rush to open new accounts elsewhere crashed other banks’ mobile apps, fueling public panic.

That Was Then: The Imagine Cup competition, Microsoft explained in a 2003 press release, “seeks to provide students [aged 16-and-up] around the world with resources to use technology and Web services to solve everyday problems […] Imagine Cup is about empowering students to apply their creativity and knowledge toward making the world a more-connected place.”

This Is Now: “Building is Hard. Selling is Harder.” begins the “Why Imagine Cup?” promo video for the 2027 Imagine Cup competition, which is pivoting to an AI startup-first focus in recognition that “A new era for founders is here.” “Since 2003, Imagine Cup has empowered emerging innovators to turn ambitious ideas into real-world solutions with Microsoft technology,” Microsoft writes of the Imagine Cup Evolution. “Now part of Microsoft for Startups, Imagine Cup enters its next chapter in 2027, opening the competition to eligible early-stage startups and founders everywhere.”

An Eligibility FAQ drives home the point that Imagine Cup is no longer a student-only competition: “Imagine Cup 2027 welcomes eligible early-stage startups across seven categories; founders do not need to be students.” And if you think making high school students compete against seasoned full-time employees of startup companies seems a tad unfair, Microsoft advises: “Eligible student-led startups are encouraged to enter the Student Startup category but may choose an industry category instead.” The #1 overall startup will win a $250,000 cash award and $1,000,000 in startup credits. However, Student Startup category entrants are ineligible for the open category prizes (where the 2nd-place winner gets $50,000 cash and $350,000 in credits, while 3rd place is good for $25,000 and $350,000 in credits); they will instead compete for a single prize of $25,000 cash and $250,000 in credits. The Official Rules (PDF) note that all startups must have a valid Azure Subscription ID and a Microsoft for Startups account.

The crewed X-70 features advanced, rapidly reconfigurable flight-control technology that will allow NASA to explore aircraft maneuverability in ways never before demonstrated in crewed flight. The aircraft can also accommodate up to 2,000 pounds of experimental payloads in internal and external locations, enabling a wide range of research and flight-testing opportunities.

The X-70 Fractal has a takeoff weight of 10,000 pounds and is designed to cruise at Mach .75, reach altitudes of up to 45,000 feet, and provide an operational range exceeding about 1,726 miles (1,500 nautical miles). These capabilities will enable NASA to conduct demanding flight research across a broad range of operating conditions.

The X-70 joins a storied legacy of experimental aircraft that have helped establish America’s leadership in aviation. From the Bell X-1, which first broke the sound barrier in 1947, to the X-15 hypersonic research aircraft and today’s X-59 quiet supersonic demonstrator, NASA has spent decades pushing the boundaries of flight. With the X-70, NASA will expand its capacity to conduct experimental flight research, accelerate the testing of emerging technologies, and advance the next generation of American aviation.

3M chairman William Brown called the settlement a “significant milestone” that substantially reduces uncertainty from the litigation. […] Fred Thompson, an attorney with the Motley Rice law firm that helped negotiate the 3M settlement for the plaintiffs, called it welcome news for “the thousands of victims who have sought answers and accountability for nearly a decade.” He said in a news release that the plaintiffs urgently need help covering mounting medical bills and other costs.

Under the terms of the settlement, the payouts will begin with $50 million this year, followed by yearly payments of more than $1 billion each year from 2028 to 2033. 3M could make additional payments if enough plaintiffs participate. If too few sign on, 3M has the option to cancel the settlement and continue fighting the lawsuit.

A Vietnamese court has sentenced 14 people who worked on the pirate football streaming site Bun Cha TV, handing out the first prison terms we’ve seen since the country’s piracy crackdown began earlier this year. […] Four defendants, including the heads of the content, programming and operations teams, were sentenced to 12 months in prison. Five others received ten months, and two were sentenced to eight months. Notably, three of the site’s commentators were not sent to prison. Their ten-month sentences were suspended. All 14 defendants reportedly admitted the charges and cooperated with the authorities. According to investigators, Bun Cha TV streamed more than 150,000 sports matches and it allegedly made more than 20 billion dong, roughly $760,000, in illegal profits from betting and gambling ads.

The verdict reports don’t mention a total. Instead, they list illegal gains per person or team. The leader of the content team allegedly gained more than 430 million dong, while commentators made from more than 31 million to more than 480 million dong each. The verdict was picked up by Rouse, the law firm that represents the Motion Picture Association in Vietnam. In an article headlined “Strong Vietnam criminal penalties,” published on Lexology on November 3, the firm calls the ruling another victory for Vietnam’s IP landscape.

“The defendants were all sentenced to terms of 8-12 months in prison,” Rouse writes. While Rouse is correct on the length of the terms, it doesn’t mention that three of the sentences were suspended. Instead, Rouse stresses that the ruling is part of a tougher enforcement trend. “This ruling reflects a shift in enforcement strategy by Vietnamese authorities, who are increasingly moving past preliminary domain blocking to deliver criminal convictions against the operators of commercial-scale piracy rings,” the firm notes. “This perhaps reflects the strength of the national crackdown following the USTR pressure in May,” the firm adds.