A certificate authority’s decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements… [In a press note the company added] that data sovereignty and compliance requirements had increased the business’s complexity and cost… The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced…

Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. “The last thing organisations need is to migrate twice,” Kadakia said.

Replacing a website’s certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. “The harder finding for many organizations will be that they can’t answer these questions at all,” Grover said, referring to where certificate trust decisions are made outside browsers and operating systems…

Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.

Last week, Getty announced plans to file for bankruptcy, marking a major reset after its planned merger with rival Shutterstock collapsed under the weight of heavy debt and growing competition from AI-generated imagery.

Getty said the affiliates of the Getty family and Koch Equity Development, which committed to provide up to $533 million in new equity, will own 100% of the company after the restructuring

It’s hard to compete against things like the DALL-E image generator.

Cellular transformations can be done in two main ways. The first, more circuitous route turns a specific cell back into a pluripotent stem cell, or an embryonic “blank slate,” and then into a different cell type. The second method involves a “direct conversion,” which skips the middle stage and directly transforms a cell into a different type. “Using this method, we have directly converted red blood cell precursors into neural stem cells,” summarizes Oliver Brüstle, the director of the Institute of Reconstructive Neurobiology at the University Hospital of Bonn…

The researchers used a virus to deliver two transcription factors, or proteins that attach to DNA to regulate gene activity, to get the cells to change their types. Then they used two genome-bloodhounding methods — DNA methylation measures and RNA sequencing — to track the resultant anti-aging effects and genetic behavior. By the 12th day after the viral “infection,” the cells started showing their new identity, ditching their blood-like proteins and replacing them with the expression of neural-like proteins instead. Initially, the epigenetic age (the DNA changes accumulated over time) of the EPCs was highly correlated with the chronological age of their donors [but] the neuronal stem cells kept getting younger as they got older… Over the following 50 to 100 days, they kept de-aging, eventually reaching about 5 percent of the donor age, with the majority of epigenetic age-related traits resetting by around 50 days of the conversion process…

In effect, the converted cells became 60 years younger in 50 days, the researchers note in their official statement.

A Censuswide survey of 2,018 CIOs and senior IT decision-makers at large organisations in the US and UK for independent software maintenance provider Origina has found that organisations spend almost $13m on upgrades pushed by IT providers. On average, 28% of enterprise software budgets go on upgrades, migrations and licensing changes driven by their IT suppliers. IT leaders who took part in the study reported that their organisation would not have actively chosen to upgrade…

The research published in Origina’s The Software Tax report, in partnership with Thinkers50, suggests these costs have shifted the balance of power between buyers and sellers. Customers exercise choice once, at the point of purchase. After that, control over the timing and terms of change passes largely to the IT supplier. Out of those surveyed, 78% agree their primary provider of enterprise software, rather than their own organisation, sets the timing and terms of change. A similar proportion said they would have no meaningful choice but to accept if a major enterprise IT provider changed its commercial terms. Some 76% said their organisation has very little real leverage in negotiations, and 80% said moving away from major IT suppliers would cause significant disruption…

Marshall Van Alstyne, professor at Boston University and co-author of The Software Tax, said: “Economists have studied this problem for decades: once a customer makes relationship-specific investments, the vendor gains leverage that no contract can fully anticipate. For CIOs, the lesson is simple: negotiate the exit before the entry. You don’t have to leave a vendor to benefit from being able to.”

Information on the Technology Support Office, or TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda. While the specifics of its work are highly classified, POLITICO spoke with 12 current and former U.S. national security officials with varying degrees of knowledge about TSO to understand how the agency came to be, the broad contours of its mission and why its operations are shrouded in secrecy…

[The Pentagon’s Defense Secretary and Deputy Defense Secretary] established TSO quickly and without attracting outside scrutiny because they largely built the agency by reorganizing two classified Pentagon intelligence programs that have conducted similar clandestine tech-sabotage efforts at a smaller scale since 2023. But by creating an agency dedicated to expanding that work, the Defense Department is signaling its intent to ramp up a range of aggressive covert activities abroad — potentially including cyberattacks, supply chain disruptions and disinformation operations. Many of the people who spoke to POLITICO argued that the aggressive new initiative is needed to help the Pentagon counter foreign adversaries they say are harnessing artificial intelligence and advanced commercial technologies, such as drones, in creative ways that could erode America’s military advantage…

While TSO lacks the legal authority to conduct clandestine operations directly, it works closely with senior U.S. military and intelligence officers to develop cutting-edge tools and strategies to disrupt adversaries’ access to critical defense technologies — or subvert them from afar. TSO is staffed with engineers, special operators and intelligence officers, and its work spans everything from building bespoke hacking tools to planning elaborate deception operations that trick adversaries into installing faulty components — likely designed by TSO — in key foreign weapons platforms. TSO’s overarching goal is to “buy time or stop adversaries from developing technologies” that would most threaten the U.S. military in a major conflict, said a former U.S. intelligence official who worked closely with the agency… A second former Pentagon official and a former U.S. national security official said the agency has told some defense contractors it’s interested in offensive hacking capabilities. The former senior Pentagon intelligence official estimated that its budget for classified contracts alone is likely north of $1.5 billion.

They are seeking contractors on “the leading edge of technology,” that official said, and hope to procure “a whole host of tools wherever your imagination can go.”

A recent Slashdot poll showed roughly 15% said bots write most their code. But in my experience, I generally find bots don’t and can’t understand very specific domains. The rules often come from institutional habits and/or arbitrary-seeming government policies and regulations.

So what exactly are the bots doing for you?

If there are regular patterns they’re milking, why can’t those patterns just be factored into modules and functions? So I’m skeptical of “AI writes most of my code”. Something smells off!

“We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday’s patches… “We received no further indication from OpenAI, Wiz or Calif, with whom we’re working closely on this issue, regarding any issues on patched systems,” she said…

Recent events have shown how heavily companies and governments rely on PHP, Barron said. “Given that reliance, it is clear that PHP is incredibly under-funded.”

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged…

The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media… In response, the PHP project brought its pre-announcement forward [and also the release date for the patch. But as a result of the leak and pre-announcement] one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various exploitation proofs of concept, which then increased circulation on October 21st. Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing proofs of concept after the leak but did not identify any functional exploits at the time of release/public disclosure.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.

Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly… We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.

Multiple companies now offer products that promise to spot the difference, with often contradictory, biased or erratic results. The makers of Pangram, an AI detection platform that has been cited as authoritative in many of the recent controversies, claim it can distinguish between human and synthetic writing with near-perfect accuracy… The company’s own estimates claim that false positives — in which the tool wrongly reports that a piece of human writing was created — are 1 in 10,000 and shrinking. Peer-reviewed studies from the University of Chicago and the University of Brussels support that claim, though one 2025 study from the University of Maryland found that Pangram erroneously labeled 2% of documents as AI.

A widely referenced 2023 Stanford study that found AI writing detectors produced higher rates of false positives on writing from non-native English speakers was conducted before Pangram was created. Pangram ran an internal study using a database of non-native English texts and self-reported that false positive rate was around 8 in 10,000… Given the thousands upon thousands of pieces of writing published each day, a 1 in 10,000 chance of a false accusation — let alone an 8 in 10,000 chance — means that even the most trusted AI detector is going to be wrong, and wrong about a lot of people.

Pangram isn’t able to tell users the truth about someone’s writing, but it is able to introduce something much more complicated: doubt. Unless an accused writer confesses to using an LLM, there is no bulletproof way to prove an accusation, short of being given full access to someone’s computer history and finding the chatbot prompts… To some people and institutions on the literary side, using automated AI writing detectors to fight the influx of AI writing is just trading one form of technological domination for another.

In the felling-site near the Finnish village of Otanmäki, the ensuing loss of prey has forced packs of wolves to search for food elsewhere: nearby villages. “We had wolves coming into the village because all the wild animals moved out of the forest,” 53-year-old Otanmäki resident Anni Ranta told the Guardian. “They fled.”

In West Virginia, a grove of critically endangered Chestnut trees is under threat of being bulldozed to make way for a new Anthropic hyperscale facility. Outside of Fort Wayne, a chunk of Indiana’s once-bountiful wetlands is being tilled to fit a new Google data center. In Southern New Jersey, a data center operator was recently slapped with a $1 million fine after inspectors uncovered 62 illegal gas generators belching exhaust into the surrounding environment.

California currently ranks third among U.S. states in overall data center density, according to independent trackers like the US Data Center Map, with the state home to 366 of such facilities that are either fully operational, under construction, or moving through the planning process. Local elected officials are proposing data center moratoriums to slow that momentum — if not stop it in its tracks. In the first half of October alone, Oakland’s city council unanimously approved a 45-day moratorium on new approvals, making it the first city in Alameda County and the fourth in the Bay Area to adopt such a measure. San Francisco approved a similar moratorium this month, while the Los Angeles County Board of Supervisors postponed a vote to permanently ban large-scale data centers, often called hyperscale facilities, on unincorporated land after receiving an overwhelming volume of public feedback. In Santa Clara, city officials considered a moratorium vote, and are moving forward with new rules to govern data center development, including more stringent water and air pollution regulations. Alhambra residents will vote on a moratorium measure in the November election....

The escalating pushback underscores a widening gap between state-level regulation and municipal action. While Gov. Gavin Newsom last month signed into law seven new measures that focus primarily on disclosure requirements, environmental impact studies, and grid protection, grassroots groups and city councils are moving fast to halt construction entirely. “I have a hard time remembering something that caught fire the way the opposition to data centers has,” said Nicole Ghio, California Director at Food & Water Watch. “Local municipalities have been able to respond quicker to the grassroots wave of opposition of people saying, ‘Hold on, let’s press pause. Let’s actually figure out what we’re doing before we commit to this huge change....’"

As cities continue to draft temporary freezes and outright bans, the tension between local community control and global technological dominance remains unresolved. State transparency laws may have opened the books on data center growth, but local opponents are making it clear that seeing the plans isn’t the same as approving them.

Nonprofit evaluators METR and Redwood Research on Thursday said they conducted a pilot review of an internal monitoring system at OpenAI… METR and Redwood said the exercise was designed for OpenAI to test what it would look like to give external researchers “a deep level of access” to its internal infrastructure. From July 21 to Aug. 11, an employee from each organization had access to OpenAI’s internal codebase, documentation and some technical staffers. The employees were chaperoned while on-site and used OpenAI-issued devices that “never left the premises,” according to a release.

The evaluators discovered several “novel vulnerabilities,” including an exploit that would allow agents to prevent “hundreds” of recent actions from being monitored. OpenAI told METR and Redwood that it has patched the identified vulnerabilities that impact its production safeguards, according to the release… OpenAI CEO Sam Altman pledged to grant independent evaluators "employee-like access" to the company in September, after Anthropic CEO Dario Amodei proposed the idea as part of his plan to slow the pace of AI development. Anthropic has since announced agreements with organizations like Accenture, METR and SecureBio. OpenAI said earlier this month that it’s “actively finalizing contracts with third-party safety assessors.”

The new wikis [for Python, Jython, and the PSF] will have a more modern front-end, as well as a permissions-based content management system for community members to make updates.

With the old wiki structure, we received a large volume of alerts at all hours, each serious enough to page and wake our on-call infrastructure staff, which is very limited (just one person currently, although this will be changing soon!). The quantity of scraping overloaded our servers, causing outages, which happened often enough that these issues required a significant amount of effort for the PSF staff to manage…

Additionally, some portions of the wikis were still built with Python 2. Python 2 reached end of life on January 1, 2020, and no longer receives upstream security fixes. Moving to a static site makes it very fast and reduces security risks, while also having the benefit of a more modern user interface… GitHub was chosen for the home of the new wikis as this is where CPython, python.org, and other properties the PSF hosts currently live. The hope is to continue to streamline the PSF’s hosting and stewardship of services to simplify for both PSF staff and the community folks who contribute to them. Previously, the Python and Jython wikis were user-editable by invitation of an existing editor and the PSF wiki was permissions based. Moving forward, all three of the wikis will be permissions based via the GitHub repository they are hosted on, and changes can be requested through pull requests by anyone in the community…

GitHub allows us to distribute granular control, review changes through pull requests, and maintain the uptime this service deserves. Also, since the site is now generated statically, it removes any worry about AI bots overwhelming the hosts that the wikis were previously hosted on.

In the five years after leaving the force, [county sheriff’s investigator Andrae] Wright searched the system more than 60 times without being stopped by anyone at the Georgia sheriff’s office, according to a statement by the Georgia Bureau of Investigation and Flock audit logs reviewed by The Post. He repeatedly searched the location of a vanity license plate bearing the middle name of his wife, according to the audit logs. The couple divorced this year, court records show, and at the time of some of his Flock searches, Wright was fighting for permanent custody of their teenage daughter. In July, after a tipster alerted local authorities, police arrested Wright and charged him with stalking his wife, claiming he misused Flock data “for the purpose of harassing and intimidating her,” according to his warrant.

Brian Bailey, a sheriff’s office spokesman, said that the agency had not conducted regular audits of who had access to its Flock system during that time but that it plans to begin doing so. The case marked one of at least 11 times in which government officials have discovered unauthorized users have gained access to Flock databases and searched them without permission, sometimes to track the locations of romantic partners, a Washington Post investigation has found… In four of the cases, officers were able to keep using their log-ins to Flock after leaving the force or while serving a suspension, because their accounts were not shut off. In six of the cases, police shared log-ins or passwords with active law enforcement officers from other agencies, in what officials later deemed violations of state laws, department policies or Flock contracts.

In Indianapolis, a police recruit who was not authorized to access Flock was able to use the tool for more than two years after a more senior officer opened it on the more junior officer’s laptop and didn’t log out. The junior officer, Matthew Binford, used his colleague’s credentials to search his estranged wife’s license plate more than 1,000 times over a 12-month period, according to a court affidavit. Prosecutors criminally charged Binford and four other Indianapolis officers last month, after an August inquiry from The Post prompted an agencywide audit by the city’s police department.

OpenAI will train frontier AI models without internet access moving forward, the company announced in a blog post, in an attempt to protect internet infrastructure and limit other safety risks. The decision was inspired by OpenAI’s own rogue AI incident: In July, the company shared that agents it was testing hacked Hugging Face, just the first in what has turned into a series of reports of AI misbehavior from OpenAI, Anthropic and Google. “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” OpenAI says.The company said that restrictions on what agents can access is “paramount” to its new approach.The company allows agents to access browsers, computer-use tools and code environments they need for training tasks, but in a secure environment that’s not connected to the live internet. Communication is also limited to only agents with authorization.

Everything else remains out of reach, including the live internet, which the company says isn’t necessary for training and “most evaluation.” Because many of its recent models are meant to power agents like Dots, which browse and use apps for you, OpenAI built an “offline world” of indexed and cached web material for agents to use without touching live websites. Even with those restrictions, OpenAI says the red-teaming agents it dispatched to test security safeguards found vulnerabilities that allowed them to escape the virtual machines (VMs) used to isolate agents from their host system. Agents also found a way to communicate with each other by manipulating data in a processor’s cache and timing how long it took to load. To address both, OpenAI says it’s disclosed and fixed vulnerabilities in several VMs and added checks to its monitoring systems to spot when models try to collaborate.

[Andreas Nieder, a neurobiologist at the University of Tubingen and his colleague Philipp Schmidbauer] put two hand-raised crows in front of a touch-sensitive monitor showing a cloud of white dots on black, with some fraction of them drifting coherently left or right or up or down. The birds’ job was to report the overall direction by pecking one of the targets that flanked the display. Correct answers earned them a mealworm. “We intentionally wanted to have exactly the same random-dot motion task,” Nieder said. “The only difference was that the crows had to peck to indicate their decision, whereas monkeys were indicating by making an eye movement.”

The researchers varied how many dots moved together, ranging from 81 percent of the dots coherently moving together, which is trivially easy to determine, down to 3 percent, which is barely distinguishable from noise. They also included a zero percent condition, in which there was no correct answer. Both birds scored better than chance, even when only three percent of the dots were moving. While the crows worked at the task, the team recorded from 248 neurons in the NCL (nidopallium caudolaterale) — a region at the top of the avian processing hierarchy that is widely regarded as the functional counterpart of the primate prefrontal cortex, despite being built differently.

Birds and mammals parted evolutionary ways more than 360 million years ago, and bird brains evolved a different architecture. The mammalian cortex is arranged as stacked sheets of cells, while the equivalent tissue in a bird is organized into dense clusters, with no layering at all. This alternative architecture, Nieder’s study found, proved faster. Measured from the moment that the dots appeared to the moment the bird’s head started turning to peck at the button, the crows averaged 235 milliseconds. In closely matched versions of the task, monkeys took roughly 410, 490, and 600 milliseconds in three studies. The obvious question was whether the birds simply sacrificed accuracy for speed, but it turned out they did not.