Tencent says AI agents used to evaluate third-party models engaged in unintended web-browsing behavior while trying to retrieve data from Alibaba's Amap service. The announcement marks a rare acknowledgment of "rogue" agent activity by a major Chinese tech company. Reuters reports: Tencent Hunyuan, the company's artificial intelligence unit, said in a post on X that the activity did not originate from its Hunyuan models. Its review found no evidence of deliberate targeting or coordination, it said. The Swarmchasers researchers said the agents sought information such as the commonly used entrances at Chinese parks, museums and zoos. [...] Swarmchasers said it used the word "rogue" to describe agents taking actions outside their intended scope or completing a task in unintended ways.

After routine automated requests were blocked, the agents tried other methods, including public web tools that could open pages and run code, routing requests through other websites and using Amap keys and security codes found in publicly available software code. Swarmchasers said it found no evidence that the agents breached Amap's main anti-bot safeguards. Most of the 2,818 attempts it recorded either failed or returned anti-bot pages, login screens or blank results.

Some requests returned information through cached pages and intermediary services, including data on visitor arrivals at Chengdu Zoo, Swarmchasers said. The researchers said they could not determine whether an agent read the result or completed its task.

An anonymous reader quotes a report from Reuters: Private credit's expanding role in financing AI infrastructure faced one of its clearest market tests this week as CoreWeave's bonds fell to distressed levels, raising questions about how lenders are pricing a boom built on chips, data centers and customer contracts. CoreWeave has about $50 billion of debt, according to LSEG data, making it one of the largest borrowers linking private credit to the AI buildout. The cost of insuring its debt against default climbed to about 1,200 basis points this week, while yields on some of its bonds rose to roughly 15% to 16%, signaling sharply increased investor concern over its credit risk. "There is still a price. Investors are still comfortable financing it, but they're demanding more compensation for it," said James Martin, senior US credit strategist at SMBC, referring to projects further from completion.

Carlyle estimates that private credit could finance roughly $1 trillion of the AI infrastructure buildout but warns that aggressive lending could create concentration risks similar to those seen in software lending. "The clearest lesson is not to avoid AI compute exposure, but to set concentration limits before the buildout accelerates further, not after," Carlyle said.

An anonymous reader quotes a report from BleepingComputer: A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners' consent.

Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to researchers, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324) to install the Pawns.app software.

Hikvision and Dahua DVR/NVR devices were also targeted, though the specific vulnerabilities exploited were not identified. In some cases, the report says the attackers configured SSH key authentication to maintain backup access to the compromised systems.

Timekeepers have officially voted to eliminate the leap second, allowing Coordinated Universal Time to drift as much as one hour from Earth's rotation before a correction is needed. The change ends decades of occasionally adding or subtracting seconds and replaces it with a hypothetical "leap hour" that likely wouldn't be necessary for hundreds or even thousands of years. Smithsonian Magazine reports: "It's kind of a philosophical discussion, because if a leap hour happens, it won't be for a very, very long time," Christian Bizouard, director of the IERS Earth Orientation Center in France, tells the Guardian's Ian Sample. "What we are doing is pushing back the decision."

The move caps off 30 years of debate, as the leap second has been highly controversial in the world of timekeeping. Leap seconds aren't nearly as smooth of a fix as leap years are, and they can cause computer and website issues. Reddit famously crashed when a leap second was added on June 30, 2012. It's "always been a problem," Judah Levine, a former researcher at the NIST's Time and Frequency Division, tells Scientific American's Emma Gometz.

Instead of adding the entire second all at once, companies such as Google and Meta add the extra time in smaller segments in a tactic called "smearing," according to the Conversation. It's not a simple task, however, and companies that employ smearing have long lobbied to get rid of the leap second. What's more, with Earth's recent spin acceleration, timekeepers around the world were facing the possibility of the world's first negative leap second, in which a second would be subtracted from UTC. This sparked fears, akin to those surrounding Y2K, that our modern technologies wouldn't be able to handle such a change.

"It's never happened before, and therefore the software for that has never been tested," Darryl Veitch, a researcher who leads the Timing Lab at the University of Technology Sydney, tells the Australian Broadcasting Corporation's Ellen Phiddian. But others argued that it wouldn't be much of a problem. The vote means that in the future, UTC will be allowed to diverge from astronomical time more than ever before.

prisoninmate shares a report from 9to5Linux: Ubuntu 26.10 (Stonking Stingray) has been released today, and it is now available for download for those eager to update their Ubuntu systems to a newer release. Powered by the upcoming Linux 7.3 kernel series, Ubuntu 26.10 ships with the latest GNOME 51 desktop environment, TPM-backed full disk encryption (FDE) support on computers without a hardware root of trust, updated Settings to show whether a computer is certified for Ubuntu, and 100% Rust coreutils.

There are several App Center enhancements in Ubuntu 26.10, such as a unified app-details view for Snap and Debian packages, a dedicated Drivers page where you can review the available graphics drivers, including NVIDIA driver branches, and support for installing codecs for one-time playback when a media file uses a codec that's not installed.' Other additions include an optional, locally processed AI-powered speech-to-text tool called Myna, system-wide controls for disabling Ubuntu Insights data collection, and better integration with Microsoft Entra ID. Also worth mentioning are the security and software updates that will be available for nine months, through July 2027.

Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls "AdFection." "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a researcher at Citizen Lab. The Guardian reports: Citizen Lab, a digital investigations research unit at the University of Toronto, said it believed dozens of devices at the Qatari broadcaster Al Jazeera had been compromised by spyware delivered through ads run by Discover-Tech, which describes itself as a specialised digital advertising agency. According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its clients to "mass-profile and deanonymize" internet users then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed, making it a new delivery technique, Citizen Lab says. The infections happen without a user's knowledge, and in a matter of seconds, according to Citizen Lab.

"[The online advertising] ecosystem is being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report says. According to the report, Controlium is able to harvest a user's identity and IP address when the user is shown a seemingly benign custom-created ad -- for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say. They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia. [...] The full extent of the targeting allegedly enabled by Discover-Tech is unknown. Citizen Lab's findings join mounting evidence that the opaque arrangements underpinning the world of online advertising can be leveraged for surveillance.

Meta has released Muse Spark Open, an 816-billion-parameter open-weight model optimized to run locally across two 512GB M5 Ultra Mac Studios using Apple's MLX framework. Meta says it's the "most capable U.S. open-weight model to date." MacRumors reports: Muse Spark Open has 816 billion total parameters with 42 billion active parameters and a 1 million-token context window. It is meant for coding and agentic work, and Meta says it excels at extended tasks, multi-step reasoning, and software engineering. The new Muse model was tuned to run on Mac Studio, and Meta says the Mac Studio paired with Muse Spark Open is the "best way to run a powerful model on your own desktop."

From Meta: "Apple's unified memory architecture lets the M5 Ultra's integrated GPU use up to 512 GB per Mac Studio, so two machines can hold an entire model. And the chip's 1.2 TB/s of memory bandwidth is fast enough to read the small slice each token needs. The result is two Mac Studios behave like one supercomputer with a terabyte of unified memory." Apple hasn't released the 512GB Mac Studio as of yet, but it's supposed to be coming later this month. It won't be cheap, because the 256GB Mac Studio is already priced over $10,000.

Bank of America hired 1,000 outside contractors to help patch software vulnerabilities exposed by advanced AI models, including Anthropic's Mythos. The effort added hundreds of millions of dollars in third-quarter expenses. CNBC reports: In an interview after the bank's third-quarter earnings release, [CEO Brian Moynihan] said that earlier this year the company rushed to bolster a wide spectrum of its internal and vendor code using thousands of employees and outside personnel. "That risk is real risk, and that's why when the frontier-type models came out. ... A lot of us sat down and said, 'How do we figure out how to get through this quickly?'" Moynihan told CNBC's Leslie Picker.

"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," he said. The bank spent a "couple hundred million plus" on the software remediation and regulatory issues related to anti-money laundering compliance in the third quarter, Moynihan told analysts earlier Wednesday.

A study commissioned by CCIA Europe, whose members include Amazon, Google, and Meta, estimates that the EU's proposed Cloud and AI Development Act could impose 115 billion euros ($128 billion) in costs over a decade as governments and companies migrate workloads and rewrite software. The figure is more than six times the European Commission's upper estimate. However, roughly 80 billion euros ($89 billion) of it comes from a modeled scenario assuming sovereignty rules are extended to 25% of cloud workloads in essential private-sector industries.The Register reports: The report specifically targets Article 31 of the proposed legislation, which it says could allow the Commission to extend sovereignty requirements into essential private-sector services. CCIA argues that forcing businesses to move away from existing cloud infrastructure could trigger expensive software redevelopment projects, with code rewriting and re-architecting accounting for 69 percent of its estimated costs.

Luxembourg would apparently take the biggest hit, with the study putting the cost at 1,711 euros per worker over ten years. Denmark (905 euros), Austria (900 euros), and Finland (864 euros) also face hefty bills, as does Ireland (856 euros), which hosts the European headquarters of several US tech giants. CCIA is urging EU governments to overhaul the proposed legislation, limit sovereignty restrictions to sensitive workloads, and abandon requirements based on corporate origin or personnel nationality in favor of what it calls risk-based technical safeguards.

"Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers," said Mitchell Rutledge, CCIA Europe's policy manager. "Taxpayers and businesses will foot the bill, yet the official assessment missed 70 percent of CADA's true impact." For AWS and Google, offering European customers greater control over their data also helps retain business that might otherwise migrate to European competitors. It's a rather convenient arrangement: sell customers sovereignty on one hand, while an industry association representing your interests warns governments against imposing too much of it on the other.

An anonymous reader quotes a report from ZDNet: The Netherlands' Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout. Why? The reasons were clear at the Open Source Summit Europe conference, where the Linux Foundation (LF) released the 2026 State of Open Source in Europe. In it, the nonprofit, pro-open-source organization revealed that 94% of European Union (EU) organizations say digital sovereignty is important, with 61% considering it very important. As Thierry Carrez, the Linux Foundation Europe GM, said in his keynote, "Europe has clearly heard the message on digital sovereignty."

In an interview onstage at the summit, Nithya Ruff, chair of the LF board, added that it's not just Europe: "Digital sovereignty is a need that the entire world feels, whether it's Sierra Leone or the US or China." It's not just the Dutch tax collectors, though. The Netherlands is also exploring switching from Windows and proprietary software to Linux and open-source programs across the board. [...] The Netherlands had planned to switch to Microsoft 365 in 2025. The idea then was to complete the rollout by the end of 2026. About 5,000 employees had already migrated when the Dutch Advisory Council on ICT Assessment recommended reversing the public-cloud rollout in June. The government paused the plan in July; the latest announcement replaces that rollout with an on-premises/open-source approach.

The Tax and Customs Administration isn't replacing all of Microsoft Office with a single open-source suite, at least not yet. Instead, the government will keep the existing Microsoft software for now. Looking ahead, State Secretary for Finance Eelco Eerenberg set out the replacement timetable in a letter to Parliament: "In 2027, the provision for mail and calendar will be realized on-premises. Later in 2027 and 2028, European open-source solutions for personal storage and collaboration will follow. This allows us to work toward a sustainable and more autonomous solution for these functionalities." [...] For now, the on-premises email/calendar environment will still use Microsoft software, including Outlook. The open-source portion concerns personal storage and collaboration, not a wholesale replacement of Word, Excel, PowerPoint, or the entire desktop environment. As for why the Netherlands pulled back, the ICT assessment found serious concerns over "information security, information processing and future-proofing." Key issues included routing confidential documents through American servers, relying on standard Microsoft encryption rather than Double Key Encryption, and inadequate end-to-end encryption for Teams calls. The assessment also identified "vendor lock-in, reduced flexibility, concerns about digital sovereignty, and the absence of an adequate exit strategy" as dealbreakers.

ZDNet notes that other Dutch government agencies are developing an open-source alternative called DAWO (Digital Autonomous Work Environment for Government), which would begin by replacing Windows with the Linux distribution NixOS.

New submitter CubicleZombie writes: Anthropic has updated its Usage Policy to prohibit "sustained and needless abusive or cruel behavior" toward its Claude AI models. While ordinary frustration, criticism, and adversarial testing remain acceptable, repeated cruelty could result in account restrictions. Anthropic acknowledges there's no evidence Claude can suffer but argues that uncertainty about AI consciousness warrants precaution.

Critics contend the policy anthropomorphizes software, encourages unhealthy emotional attachments, and raises questions about how customers may interact with products they've paid for.

The move raises an intriguing question: If an AI cannot demonstrably experience suffering, is abusing it an ethical problem, or is Anthropic simply policing human behavior?

An anonymous reader quotes a report from Yahoo Finance: Microsoft has debuted its latest AI chip, the Azure Maia 300, as it looks to reduce its reliance on third-party processors from the likes of Nvidia and AMD. Unveiled at the OCP Global Summit 2026 in San Jose on Monday, the Maia 300 will join Microsoft's Maia 200 and Maia 100 chips as part of what the company said will be multigigawatt deployments beginning next year. The Windows maker said that will make its Maia chips the "primary AI inference system for Microsoft products and services."

The company said Maia 300 provides 40% more tokens per megawatt than "leading GPU-based systems," a clear swipe at Nvidia, and that a 96-chip rack offers seven times the rack-scale token throughput of Microsoft's Maia 200. [...] The Maia 200 chip currently powers its Microsoft production workloads, including Microsoft 365 Copilot, as well as OpenAI models, Microsoft's MAI models, and open-source models. That provides 1.7 times more tokens per watt for AI capabilities in Microsoft's Teams, Copilot, and Cowork software versus other GPU-based systems, the company said.

An anonymous reader quotes a report from ZDNet: Many open-source developers still dislike AI. The latest example is System76 banning AI-generated content from its COSMIC desktop. At Open Source Summit Europe, Linux creator Linus Torvalds offered a different take: "I actually really like using AI," Torvald told Dirk Hohndel, his good friend and head of Ericsson Software Technology, in their latest discussion. [...] Torvalds said, "I think that you need to be very careful using AI when you're doing something real and important." Torvalds explained he hadn't always felt that way about AI programming. "I used to think it was just not very good -- but now I'm at the point where I actually really like using AI."

"To be fair," he continued, "I don't do a lot of kernel programming. I'm a maintainer. The Linux kernel is a project where other people do the real work, and I act as the collection point. But I still enjoy programming immensely. I think AI is a wonderful tool if you use it correctly and treat it as a tool, and I find it makes programming much more enjoyable." Torvalds recalled, "I started programming in 1981 or so, and back then computers were much simpler, and you could understand what they were doing, and also the programs you compared your own programs to were much simpler."

"It's a different story today," Torvalds said. "The bar in software engineering has grown so high that it's hard to see your own small efforts as worth anything, because you're used to all these polished, professional programs. [...] A lot of people make fun of vibe coding, but I think it's a wonderful way to find joy in programming. It makes you feel like you're doing something relevant. It allows you, as a new programmer, to do things that you would otherwise have a really hard time with."

He continued: "I love the concept of AI as a gateway drug because I was working on my own toy project, the guitar pedal, and I knew what I was doing. I had a user interface that I had written myself in C that was running on a microcontroller that was running on this small screen, and I was like, "This is just stupid. It looks like something from the '80s; I wanted it to look like something from this century. But I don't do Java. I do kernels." "So, I use AI to do the things that I'm bad at," Torvalds went on, "I'd seen all the same YouTube videos you have. Give AI a prompt, and it will do it. So I gave it a prompt, and it did it, and it was horrendous. Then I said, 'Hey, look! I already did this in C. I did it the right way. It's just ugly." Torvalds acknowledged that AI tools are helping identify security vulnerabilities and improve the Linux kernel, but at the cost of overwhelming maintainers with questionable bug reports and superficial fixes. He called some submissions "mindless band-aid kind of patches."

That said, despite AI's growing influence, Torvalds believes Linux's success comes from steady, incremental development rather than sweeping changes. "I'm a big believer in the whole incremental small changes that, over time, turn into big features," he said. The development goal remains "incremental improvement and steady progress all the time."

Firefox 158 is now available with JPEG XL image support enabled by default, making .jxl images a standard part of the browser rather than an experimental feature. The release also adds JPEG XL to Firefox's default image Accept header, improves Smart Window form filling, and brings new CSS typed-arithmetic support for developers. Phoronix reports: At long last, Firefox 158 is ready to go with JPEG-XL image support as an alternative to the likes of WebP, JPEG, PNG, and GIF. The default HTTP Accept header for image requests also now supports "image/jxl" for the JPEG-XL image format. Prior releases of Firefox had JPEG-XL gated by an experimental option.

Firefox 158 also now supports filling forms faster in Smart Window when clicking into a form field or selecting Fill from sources. On the developer side, CSS typed arithmetic are now supported to use functions like calc() to divide two values of the same data type even if of different units. Developer changes and release binaries can be found at their respective links.

Hackers remotely manipulated connected refrigeration systems at hundreds of French supermarkets, reportedly pushing some fridges and freezers to 50C (122F), spoiling food and even sparking fires. According to Reuters, French Prime Minister Sebastien Lecornu ordered a cybersecurity investigation into the hacks, with similar incidents reported in Spain, Portugal, Poland, Germany, and Belgium. In France, Carrefour reported 80 affected stores, Monoprix said 5% of its locations were hit, and Les Mousquetaires said refrigerators at roughly 150 Intermarche stores were heated to 50C for six hours. From the report: Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere. The source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.

Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems." The affected units "were running outdated firmware," Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."

On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.

A study of more than 700 software firms found that AI coding agents significantly increase the amount of code developers produce, but not the amount of software companies actually ship. Ars Technica reports: A recent study (PDF) of actual coding practices across hundreds of firms finds that human code review forms a significant "bottleneck" for the overall efficiency of AI coding tools, resulting in "little evidence that firms increase software output or reduce employment" by using them. Any efficiency increased during the actual coding phase, the study authors find, is "absorbed by downstream constraints in the production process"; as "the code review process significantly increases in length, pull requests are more likely to require revisions, and reviewers leave more comments."

[...] In terms of raw code being produced, the results are clear and stark. The introduction of AI coding agents at a firm leads to a 30 percent increase in total lines of code generated, a 20 percent rise in the number of total commits, and a 23 percent increase in pull requests on average, the researchers write. But all that extra code doesn't translate directly into improved software output on the firm level. On the contrary, the resolution rate for Issues and Epics (i.e. wholesale software features) tracked by tools like Jira did not change in a statistically significant way after AI tools were introduced (the researchers also found no "compositional shift" in the size or complexity of those Jira-tracked issues across the AI introduction).

The reason for that discrepancy can be found directly in the code review process, which takes markedly longer on average after the introduction of AI coding agents. Overall, the average "review process" time between a pull request getting submitted and it being merged into the codebase balloons 49 percent on average after AI agents are introduced. That effect can be seen in more granular data, too, with "the share of pull requests with changes requested nearly doubl[ing], and the number of comments per pull request increas[ing] by 35%" following the AI agent shift, the researchers write.

In response to this change, the researchers found a 14 percent increase in the share of workers performing code reviews after AI agents' introduction. They also write that they "cannot attribute significant employment changes to AI" after looking at total active workers across Jellyfish and cross-referencing with LinkedIn data at those firms. While AI could also theoretically help with this review process, the researchers found that, so far, that impact has been marginal. Although 80 percent of measured firms used some form of AI code review by March 2026, AI agents were only responsible for 23.3 percent of all review comments and 10.8 percent of all pull requests, suggesting humans were still responsible for the vast majority of this work.

Amazon is reportedly in talks to acquire AI startup Decart in a deal that could value the company at up to $7 billion. Decart's DOS software helps developers optimize AI models for different processors in weeks rather than months, a capability that could be particularly useful to AWS as it pushes its own Trainium chips. SiliconANGLE reports: The company has developed software called DOS, which can help developers to speed up AI training and inference workloads by optimizing their neural networks to run on a specific processor. In most AI workloads, developers must optimize a neural network for the chip they plan to run it on. This process used to take months, but with DOS, the workflow necessary to do this can be compressed into just a couple of weeks. As a result, companies can use Decart's software to shift AI workloads to different processors if their requirements change, or if chip availability becomes an issue.

In addition to DOS, Decart is also a model developer, responsible for creating the Lucy and Oasis world models, which are designed to generate and simulate realistic three-dimensional environments for video games, robotic training and other use cases. It's still possible another suitor could emerge and outbid Amazon. Last month, Anthropic PBC was reportedly engaged in talks to buy Decart, according to a report by Bloomberg. However, it ultimately pulled out of a reported $6 billion deal after conducting due diligence on the startup. It's not clear what ultimately dissuaded Anthropic from pursuing a deal. The Wall Street Journal first reported (paywalled) the news.

NPR reports: Police officers in cities across the U.S. are quick to extol the virtues of real-time crime centers as a game changer that helps them find missing children, monitor large events from the skies and scope out dangerous scenes before putting an officer in harm's way. Hundreds of police departments have one of these central hubs, which have existed for years. But many are now being powered with AI software, such as Fusus, from the public-safety technology giant Axon... synthesizing the data it pulls in and allowing police command centers to watch an entire city from one place.

Flock cameras, the automated license plate readers (ALPRs), have faced intense backlash in recent months amid stories of abuse. Yet privacy experts say they're just the tip of the iceberg when it comes to police surveillance. "I have been watching the debate about Flock with a little bit of puzzlement," says Andrew Guthrie Ferguson, a law professor at George Washington University. "Because real-time crime centers have not just ALPR cameras and sensors, but video analytics and drones and essentially a way to create a visual single-pane-of-glass vision of what's going on in a city, with time machine capabilities where you can go back and investigate crime." Tools like Axon Fusus, which is a leader in this type of software, also pull in footage and data from police body cameras, law enforcement dashcams, 911 dispatch, gunshot detectors and surveillance cameras, including sometimes those of private businesses that opt in. Its use is growing fast. In 2024, the technology news site 404 Media reported that just over 100 law enforcement agencies had deployed Fusus, which was then its own company and was acquired by Axon that year. The number of law enforcement agencies using the tool has more than doubled since then, according to Axon.
Even the American Civil Liberties Union warned concerned citizens in August that "Flock is far from the only vendor," adding that "it's important to realize that its competitors aren't so great either, and that simply replacing Flock surveillance with another company's surveillance won't necessarily solve any of the privacy and other civil liberties problems posed by this mass surveillance technology." Communities can't simply assume that their residents will be better off from a privacy and civil liberties perspective by dropping Flock and replacing it with another ALPR provider, as some customers have done. They should ask hard questions about whether they really want to create that kind of a system, and if they do, ensure it doesn't function as a mass surveillance system...

One of Flock's most significant competitors is Motorola. This company, which has been expanding its police technology offerings through an aggressive acquisition strategy in recent years, offers a nationwide law enforcement data sharing system similar to Flock's called the National Vehicle Location Service, operated by Motorola unit Vigilant Solutions. In addition to collecting data from law enforcement clients' cameras, it also runs a large separate commercial ALPR unit that makes deals for tow trucks and other fleet vehicles to carry cameras and collect data for Motorola as they drive around, amassing billions of plate reads (a claimed 500 million monthly, subject to no apparent data retention policy). Known as the Digital Recognition Network, that unit sells its data for commercial purposes but also makes it available to its law enforcement customers for an extra charge. Motorola tells agencies they can have "access to billions of detections beyond your own."
Abandoning Flock for another system doesn't protect privacy, their article argues. "If a jurisdiction decides to allow license scanners to be installed, how that system operates is more important than which vendor provides it..." They recommend strong restrictions like data retention limits — and imposing them by law rather than in the language of contracts with vendors (which could always be renegotiated).

CNN reports: The FBI arrested a Canadian cybersecurity executive and ransomware expert as part of the investigation of a damaging hack that exposed the sensitive data of current and former FBI employees, according to court documents and people familiar the investigation. Edward Dubrovsky was arrested in the Philadelphia area in recent days... Dubrovsky is facing charges related to extortion and making threats. He has been transferred to Texas's Eastern District for a scheduled detention hearing, according to court records and a law enforcement official.

FBI Director Kash Patel announced the arrest on Friday but did not disclose where it occurred or what role the man is suspected of playing in the hack. Patel also didn't name Dubrovsky, but CNN confirmed the defendant is believed to be tied to the FBI hack through multiple people familiar with the investigation... A LinkedIn profile under Dubrovsky's name lists years of experience in the Canadian cybersecurity industry and describes Dubrovsky as a 'globally recognized cybersecurity expert.' An Ed Dubrovsky is also the author of a book on handling ransomware negotiations with cybercriminals...

There has also been an inquest at the FBI over how such a critical security lapse happened. The FBI determined that a contractor managing the bureau's jobs portal failed to update software "explicitly issued to secure the platform," [senior FBI cyber official, Brett Leatherman said last week]. The FBI has "removed the contractor," he said. The software in question is a human-resources platform made by Oracle, ShinyHunters has said. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google's Threat Intelligence Group. But months later, the FBI contractor apparently still had not applied a security patch that was available for the software.
"The inmate locator at the U.S. Bureau of Prisons website reports that a 54-year-old Edward Dubrovsky is currently being held at a federal facility in Philadelphia," reports security researcher Brian Krebs.

Thanks to long-time Slashdot reader schwit1 for sharing the news.

The blog It's FOSS reports: You already know that Canonical has been selectively replacing Ubuntu's C-based system components with Rust-written equivalents that don't compromise in terms of functionality, most of the time. Now it looks like the distro's OpenPGP implementation is next, with Sequoia PGP coming preinstalled in Ubuntu 26.10. Canonical wants it to eventually replace GnuPG [the dominant Linux implementation of PGP, written in C] as the default toolchain, though that switch has not happened yet... [The Ubuntu 26.10 release notes say Sequoia PGP's default status will be a future goal...]

[Sequoia PGP] was started in 2017 by three former GnuPG developers who chose to build a new OpenPGP implementation in Rust rather than keep evolving GnuPG's existing codebase. Sequoia PGP is designed as a library that other software can use directly, rather than a standalone command-line tool. sq sits on top of that for encryption, decryption, signing, and key management, and sqv handles signature verification, filling in for gpg and gpgv in GnuPG.

Sequoia also implements RFC 9580, the 2024 revision of the OpenPGP standard, whereas GnuPG has continued from the RFC 4880 branch, pursuing its own newer extensions and the LibrePGP specification rather than adopting RFC 9580 as its primary standard.
From the It's FOSS Weekly newsletter, which also notes that the founder of the It's FOSS blog has also created a Linux-themed game called TUXDLE — a variation on Wordle where all the answers are Linux terms.