All sections
News
451 stories · page 5 of 51
SecurityOpenAI agents against its own cell: in a test on copies they found microVM escapes and paths to the internet, and training resumed on 1 October, with no internetOn 23 October OpenAI described how it hardened the environment for training its strongest models. Teams of agents running its strongest models, among them the upcoming GPT-6 Astra Cyber, attacked isolated copies of the infrastructure, with its source code supplied, and found microVM escapes, paths to the internet and a channel through the processor cache. Reinforcement learning training resumed on 1 October.ScienceNASA ends the Swift mission after nearly 22 years: the orbit fell below 275 kilometres and the telescopes can no longer hold a target steadyThe Swift observatory made its final observation on 20 October. Designed for two years, it worked more than ten times longer. Below 275 kilometres, the air does not let the telescopes hold a target, and NASA expects it to enter the atmosphere within weeks.SecurityArista says the flaw in VeloCloud Orchestrator is already used in attacks, and CISA listed it together with Collabora Online with a deadline of October 26For the second time in a month VeloCloud Orchestrator is among CISA's listings. This time, per Arista's advisory, a logged-in user can gain operator rights, fixes exist for all three branches, and no setting can save you. On October 23 CISA also listed CVE-2026-110447 in Collabora Online.BuildersAnthropic donates Agent Skills to the Linux Foundation, next to MCP: engineers from Anthropic, Google and OpenAI will maintain the standard as individualsOn October 22, Anthropic announced it is donating Agent Skills to the Agentic AI Foundation under the Linux Foundation, where MCP already lives. The name, the logo, the GitHub organization and the agentskills.io domain go with it. Per Anthropic, more than 70 agent platforms already use it.ControlBrussels opens formal proceedings against Booking.com: fake listings, scams using reservation data and paid ranking without a clear ad labelOn 21 October the European Commission announced it is assessing whether Booking.com may have breached the Digital Services Act (DSA). Three areas: fraudulent listings, scams that exploit reservation data, and paid listings without a clear label. Proceedings, not a decision: no finding and no fine so far.FrontierOpenAI's models arrive in Google Cloud: Astra, Sol and Luna, for now in a closed preview for select companies, billed through the cloud accountOn October 21, Google Cloud added GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna to its model garden. Access is a closed preview for select enterprise customers; payment runs through Google Cloud Marketplace, out of existing cloud commitments. OpenAI plans general availability in the coming weeks.SecurityTwo critical flaws in PHP itself can allow remote code execution with no login, fixes exist for 8.2 through 8.5, and 8.1 and older no longer get updates from the projectOn October 21 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 against two critical flaws rated CVSS v4.0 9.2, where an unauthenticated request can run code. Cloudflare writes that they are known as PHP2Shell. On October 23 PHP described a third one, which it calls unlikely.SecurityNode.js fixed ten flaws, and one of them, in Brotli decompression, can lead to code executionNode.js's October 21 bulletin covers four High, three Medium and three Low. The only one where the bulletin mentions code execution, CVE-2026-111497, is in the Brotli decoder and affects 26.x, 24.x and 22.x. Fixes are in v22.23.4, v24.22.1 and v26.12.1.
451 stories