Join our Folding@Home team:
Main F@H site
Our team page
Support us: Subscribe Here
and buy SoylentNews Swag
We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.
Although Swift serves as Apple's primary language for macOS and iOS application development, the open-source community continues to expand its reach—driving its adoption as a multi-platform language or even a cross-platform one in fields beyond user interface design.
Tuesday's Swift 6.4 release continued that work. Along with the usual assortment of type shortcuts and async adjustments came word that Swift Build is now the default build engine for the Swift Package Manager.
Synergies have already ensued! The pairing sets the stage for a faster build process. A developer can write a program in Swift and Swift Build will automatically download and install the required dependencies, testing them for compatibility. It then compiles the code into a CPU-specific binary.
The merger also unifies the Swift developer experience regardless of platform.
With this integration, a developer can run through the entire build process in their own environment, be it Apple's Xcode IDE or a beloved command line, and all the steps will be exactly the same for a Linux, macOS, or Windows app.
Or the developer can run their builds from VS Code, thanks to a new extension available on the Open VSX Registry.
Sweetening the deal, the integrated package comes with a tool to generate an SBOM (Software Bill of Materials) for each app, listing all the dependencies in either the SPDX or CycloneDX format (SE-0509). SBOMs are da bomb when it comes to software auditing and checking for potential security bugs.
In a way, Swift is following the lead of Rust's Cargo and Go's command line, both of which run as unified toolchains, as does Bun for JavaScript. A single integrated workflow can take the place of manually calling one tool after another to schlep some code into production.
The Swift Package Manager (SwiftPM), created by Apple in 2015, is a command line automation and dependency management tool. Swift Build itself is a collection of interoperable software development tools that together orchestrate the compilation (using the swiftc compiler), linking and testing of code.
SwiftPM can work with any git repository as a source of Swift code, as well as with private repository services such as Bitbucket and JFrog Artifactory.
Most notably, SwiftPM works well with the Swift Package Index (SPI), a search service for Swift artifacts created in 2020 and acquired by Apple in June. SPI is currently the de facto repository for many Swifties, housing over 10,400 packages. Many enjoy how the registry tests each dependency for compatibility with each platform and version of Swift.
We'd be curious to see if Apple has plans for pulling SPI metadata into SwiftPM.
Swift coders not using SwiftPM and Swift Build probably employ Google's Bazel, Meta's Buck2, or the venerable CMake to manage their Swiftian assets.
This release streamlines other parts of the build process as well, such as debugging. With Swift 6.4, the default Swift debugger LLDB now has a more storage-efficient way to debug modules, namely by identifying the exact path to the module being used, instead of embedding the entire module into the debugging file, which caused considerable bloat. Now the debugger can follow a pointer and inspect the original module.
The release also features interoperability improvements with C++, Java, JavaScript, and even WebAssembly, which gets its own SDK.
To start with Swift, go to the Install Swift page. The 6.4 toolchain can be downloaded using the Swiftly command line.
https://www.politico.com/live-updates/2026/09/16/congress/paul-kills-kill-switch-bill-01081348:
Sen. Rand Paul blocked an attempt by fellow Republican Sen. John Kennedy to quickly pass legislation that would require companies to build a "kill switch" into their artificial intelligence model.
Kennedy, of Louisiana, went to the Senate floor Wednesday to try to pass his bill without holding a formal vote — a step that can be prevented by any one of his 99 colleagues. He argued that the measure was effectively a short-term step, with Congress unlikely to pass more sweeping AI legislation in the immediate future even amid fears that technological advancements could spiral out of human control.
"We are not going to get up off our ice-cold lazy butts and address this anytime soon," Kennedy said about Congress' inability to pass a more comprehensive bill. "But still we've got this risk out there that we know is real of one of these models becoming the Terminator."
Paul, however, blocked Kennedy's request to pass the bill through a unanimous consent agreement, saying from the Senate floor, "I think we should have as many facts as possible before we dictate rules for the whole economy.
"I don't oppose the spirit of this bill, but I do ask that we make sure that we have all the information," the Kentucky lawmaker added.
Paul tried to amend Kennedy's bill to establish a group that could make recommendations on AI guardrail policies to the Senate Commerce Committee. Kennedy rejected that suggestion.
"My mama didn't raise a fool," he said, adding that "a committee is a way to kill this."
Are model "guardrails" even possible in principle? How would a "kill switch" be implemented if it is part of the model, where the model could just choose to ignore it?
The AI industry likes to abuse the word "open." It appears in product releases, research papers, policy debates, and investor presentations. A company publishes model files to Hugging Face, developers run them on their own GPUs, and the release is quickly described as an "open source model." Not necessarily. It may only be open-weight.
The difference is more than a technicality. It determines whether you can merely deploy a completed neural network or whether you can meaningfully inspect, reproduce, alter, and redistribute the system that produced it. A genuinely open source system should grant the freedom to do all of the above.
Weights are the learned numerical parameters created by training. Together with the model architecture and inference code, they allow a large language model (LLM) to function. You can download an open-weight model, self-host it, fine-tune it on internal documents, and avoid routing prompts through a proprietary API.
Open weights are publicly available. They matter because running them locally can offer greater control over data, privacy, costs, supplier API changes, and vendor lock-in. They've also helped build a large ecosystem of local-model runtimes, inference providers, fine-tuning tools, and specialized downstream models.
The Open Source Initiative (OSI), steward of the Open Source Definition (OSD), makes the distinction directly: "Open Weights refer to the final weights and biases of a trained neural network." Those values determine how a model interprets prompts and produces outputs. Releasing them can let others fine-tune, adapt, or deploy the model. But the OSI adds that weights alone expose only "a fraction of the information required for full accountability."
As James Landay, director of the Stanford Institute for Human-Centered AI (HAI), explained: "Open weights are progress. You can download the model, run it on your own machine, keep it out of someone else's data pipeline. But you still can't see how the thing was built, what it was trained on, or why it behaves the way it does. That's not an open model. That's open distribution."
Without the training data or sufficiently detailed documentation, outsiders cannot determine which sources were used, what copyrighted or private material may have been included, how data was selected or removed, which languages and communities were underrepresented, whether benchmark data leaked into training, or what alignment and safety methods affected the model after pretraining.
Landay continued: "There's a wide gap between open-weight AI and open source AI." He contends that unless developers disclose training data or provide a "thoroughly documented, auditable account of it," you can't test, reproduce, or challenge the work in the fullest sense.
The OSI has its own definition of open source AI: the Open Source AI Definition (OSAID 1.0). It requires model parameters, including weights, to be made available under OSI-approved terms, but does not prescribe a specific legal mechanism for doing so.
Luca Antiga, CTO of Lightning AI and a prominent PyTorch contributor, has argued that OSAID's treatment of weights leaves "a gaping hole that will make licenses less effective in determining whether OSI-licensed AI systems can be adopted in real-world contexts."
Other open source figures have also criticized OSAID. Bruce Perens, author of the original OSD, denounced the OSAID in 2024. He later declared: "It's not Open Source! ... It's unfortunate that the Open Source Initiative itself is now involved in Openwashing."
He's far from alone. Bradley Kuhn, policy fellow and hacker-in-residence at the Software Freedom Conservancy (SFC), and Red Hat Senior Commercial Counsel Richard Fontana have called for OSAID to be repealed, arguing: "The OSI acted too quickly to impose an overly ambitious policy compromise on the community. OSAID undeniably created a rift in the FOSS community; that rift seriously damaged the OSI's reputation, authority, and influence. Meanwhile, OSAID shows no signs of having any positive policy influence on machine learning practitioners, the FOSS community, or regulators."
OSI acknowledged when OSAID 1.0 was released in October 2024 that the definition would continue to evolve. Critics contend that its central shortcomings have yet to be resolved.
That said, the Linux Foundation's Mike Dolan submitted the Open Model, Data, and Weights (OpenMDW) license to the OSI. The license has been around since 2025 and lists contributors from Amazon, Meta, IBM, Microsoft, and Nvidia, giving it substantial industry backing.
Conventional open source revolves around source code. LLMs are a different kettle of fish: they combine code, architecture, and numerical weights derived from training datasets that may be proprietary, copyrighted, or undisclosed. OpenMDW's answer is to define separate terms for a model's architecture, training data, and weights, bringing the components supplied by a licensor under one agreement.
It sounds reasonable to me, but the submission has encountered objections on OSI's license review mailing list. As Stefano Maffulli, OSI's former executive director, who led the organization while OSAID was being formulated, said: "I continue getting the impression that the OpenMDW review is tainted by an ideological bias: Because we don't like big tech and AI now is big tech, then we don't like AI; therefore, we'll do anything to block it."
It's too late to bury our heads in the sand. As Stanford's Landay put it: "Open weights answer 'Can I run this?' Open source answers 'Can I trust this, improve it, and build the next thing on top of it?' Right now almost everyone – American labs and Chinese labs alike – is answering the first question but nowhere close to the second."
We need both. Whether OSI adopts OpenMDW is an open question. Still, OpenMDW and its supporters are at least trying to establish licensing terms that cover code, data, and weights together. Unless someone succeeds, "open AI" risks becoming an oxymoron – or merely another hollow tech marketing term.
The next CEO genius tries his hand at predicting future trends in computing. Next on the chopping block ... The keyboard.
'The end of the keyboard is near': Christian Klein predicts voice translation will be the next workplace advantage
The English engineer, Henry Mill, submitted the first-ever patent for a "machine transcribing letters" in 1714. It never actually went into production, but it was a forerunner of the typewriter and then the electronic keyboard: 312 years later, Christian Klein, CEO of software giant SAP, is noting the end of an era.
It had a good run. But now it's time to go behind the shed and move to the farm up north.
"The end of the keyboard is near," he tells me. "When you encounter voice recognition from many of these large language models, [it] is super strong. Now we have to do some work to translate voice into business language and business data."
The future will be, for sure, that you are not typing any data information into an SAP system. You can instead ask certain analytical questions with your voice."
That will be the most annoying office change since the "open office" or the "paper free office". If you thought it was annoying when people just spoke on the their phones imagine the wonders of them engaging in data input or any kind of data alterations, or query or manipulation or just anything really ...
But SAP's prediction that "data-inputting" via typing will end in the next two to three years at the firm has significance well beyond the death of QWERTY.
Gone in two or three years? Suuuure.
The trick isn't using perovskites—the trick is making them last.
In one episode of the Hanna-Barbera cartoon Birdman, the eponymous hero struggles to fight the evil Dr. Shark aboard a submarine without solar energy to recharge his powers. So Birdman would surely appreciate the new perovskite solar cells developed by a team led by Simin Ma at Yunnan University, since they are designed to work underwater.
Solar cells made from perovskites rather than silicon are always a tale of trade-offs. They can be made cheaply, they can take interesting forms (like thin, flexible, transparent films), and they can convert substantially more of the incoming solar energy into electricity. The difficulty is that they tend to degrade quite quickly.
Moisture is particularly destructive to perovskites, making them a seemingly odd choice for an underwater solar panel. But these materials have another critical superpower: They can be tuned to work with different wavelengths of light. Water quickly blocks the wavelengths of light that silicon solar panels absorb, but a carefully designed perovskite cell could still make electricity in the deep blue sea. And actually, the lower light levels and cooler temperatures should help it live longer.
Tuning perovskites just requires tweaking some of their chemistry during production, so getting something that absorbs the wavelengths present a few meters deep was not a challenge. The real task was making the cells durable. The team found a particularly effective additive (polyhexamethylene guanidine hydrochloride) that helped in several ways.
It built a water-repelling layer around the material, for one. But part of the compound also gets involved with the perovskite crystal lattice, helping larger crystals form and preventing ions from moving around in the lattice structure. The additive limits some of the common ways that perovskites break down, while also improving the solar cell's electricity production.
When the researchers tested the cells under light filtered to match an ocean depth of about 10 meters, they were remarkably efficient, converting about 35 percent of that light energy to electricity. (Silicon solar panels are generally closer to 20 percent efficiency.)
After building a proper little solar panel by sandwiching the perovskite in some protective layers, the team ran real-world durability tests. First, they submerged it in seawater (using their filtered light) for about 40 days, at which point it was still at 99.6 percent of its original efficiency. Based on that, they estimate it should last 5.5 years in seawater before it drops to 80 percent—what is typically considered its useful lifetime. While terrible compared to silicon, it's well beyond what most perovskites have achieved.
They also tested a panel in the South China Sea, attaching it to a small vehicle that could maintain a specific depth and position. The panel charged some coin cell batteries for a couple of hours each at 2, 6, and 10 meter depths. There were no surprises in performance beyond noticing that power fluctuated pretty strongly at 2 meters thanks to sunlight interacting with the surface waves. At the deeper depths, the increased scattering made the light hitting the solar panel much more consistent, though dimmer. At 10 meters, it produced a little less than a quarter as much energy as it did at 2 meters.
The researchers say their design could enable "autonomous marine power systems and submerged Internet of Things infrastructure"—think uncrewed underwater vehicles and sensors, for example. Of course, if you go much deeper, there won't be enough light to work with. Birdman is still on his own down there.
Journal Reference: Joule, 2026. DOI: 10.1016/j.joule.2026.102672
UK lawmakers want an AI watchdog with the teeth to stop potentially dangerous systems reaching the public, warning that existing rules leave people exposed and struggling to hold anyone accountable.
The Joint Committee on Human Rights (JCHR) – comprising MPs and peers – said that although a number of laws and regulations apply to some AI systems, the overall legal landscape is patchy and confused. No single body coordinates regulation of AI, leaving gaps that could make it difficult for people harmed by AI to obtain legal redress.
Committee chair Alex Sobel MP said the speed and complexity of AI development made its impact hard to predict.
"What is clear is that at present we are unprepared to deal with its consequences however potentially dire they may be. Nowhere in the world, including the UK, has a current legislative and regulatory approach to AI that is fit for purpose. New legislation is needed to establish a comprehensive set of protections that deal with the entire AI supply chain and its lifecycle. A single AI regulator should be established to set policy, monitor performance and with the teeth to ensure enforcement."
[...] The report warned AI systems were prone to producing unfairly discriminatory outcomes, "which may arise from bias in the datasets on which they are trained as well as from the way they are developed and deployed. This threatens the human rights of people in the UK and elsewhere."
The MPs and peers recommended a risk-based approach, with lighter requirements for low-risk systems to avoid overburdening organizations using them.
The proposed AI bill should "mandate more demanding obligations for higher risk AI systems and models," the report said.
The committee also called for mandatory transparency requirements throughout the AI lifecycle.
"Urgent action is needed to close gaps in the regulatory framework which is currently fragmented and difficult to navigate. A single, independent AI oversight body should be established on a statutory basis. The body would act as the central point of contact for raising concerns about the use of AI and carry out oversight and monitoring of AI harms and risks," the report said.
The EU has already adopted a risk-based approach through its AI Act, which imposes different obligations according to risk and bans certain practices outright.
The US has no overarching AI law. The Trump administration's December 2025 executive order called for a "minimally burdensome national standard" and directed federal officials to challenge state AI laws it considers inconsistent with that policy.
The US has confirmed it deployed a space weapon in Earth's orbit, the first time it has acknowledged such offensive capabilities.
US Secretary of the Air Force Troy Meink said the "on orbit" weapon was necessary to safeguard US forces against hostile enemy action.
A US Space Force spokesperson said: "Space control encapsulates the mission areas required to contest and control the space domain – employing kinetic and non-kinetic means to affect adversary capabilities through disruption, degradation and even destruction, if necessary.
Russia, China mad. Space Gun race? Still unknown, for the rest of us, what kind of weapon it is. Lasers? Kinetic rods? I guess the only thing we could sort of rule out are nukes, as those are forbidden unless the US left the Outer Space Treaty.
Among its principles, it bars states party to the treaty from placing weapons of mass destruction in Earth orbit, installing them on the Moon or any other celestial body, or otherwise stationing them in outer space.
Isn't more or less any kind of space weapon, something dropped or launched or whatnot, going to be a weapon of mass destruction once it reaches the surface?
https://www.bbc.com/news/articles/ck790xg41ygro
https://en.wikipedia.org/wiki/Outer_Space_Treaty
Australia is considering using noise cameras to detect and fine drivers whos vehicle exceeds noise limits. Drivers could face fines of up to $1,200 where noice exceeds the prescribed noise limit by 15 decibels. NSW authorities last year trialled hi-tech noise cameras in the Wollongong and Bayside council areas. NSW Police are still reviewing the data obtained from the trial and have yet to announce a broader rollout of noise cameras. Police could also issue a $434 fine and three demerit points to motorists who start or drive a vehicle in a way that makes unnecessary noise or smoke, including unnecessarily revving an engine.
The Australian-first trial used acoustic technology to detect excessive vehicle noise before cameras captured the offending vehicle's registration plate.
The technology found that motorcycles accounted for about 55 per cent of detected noise events, despite representing only around four per cent of registered vehicles in NSW.
Authorities also found that aggressive acceleration was a factor in all noisy events, and that the collected data is being analysed to inform future options for managing vehicle noise.
"NASA's award decision appears to be inconsistent with the eligibility criteria."
In theory, developing a spacecraft that will fly to Mars, insert itself into orbit around the red planet, and relay transmissions back and forth to large satellite dishes on Earth is a relatively straightforward proposition.
NASA's procurement of a "Mars Telecommunications Network" spacecraft, however, has turned out to be one of the most engrossing dramas of the year for the US space agency.
The agency finally reached a decision earlier this month, selecting Blue Origin to develop, launch, and operate a $700 million spacecraft at Mars. However, the main competitor for the award, Rocket Lab, was not happy—at all. On Friday, the company filed a protest of NASA's decision with the US Government Accountability Office.
"NASA's award decision appears to be inconsistent with the eligibility criteria mandated by Congress," the company said on X. "In addition, the agency's punitive review of Rocket Lab's technical volume was inconsistent, making incorrect assertions and conclusions."
In response, Blue Origin said the protest could potentially delay the mission's goal of launching in 2028
"We remain confident in the strength of our proposal, in NASA's rigorous selection process, and in Congress's clear intent to support competition for the Mars Telecommunications Network program," the company said. "We look forward to advancing this urgent mission. With limited Mars launch windows, any delay will greatly risk the timely deployment of this critical communications capability."
Rocket Lab's protest announcement references "eligibility criteria mandated by Congress," and this appears to be the heart of the issue at hand.
The origin of the Mars Telecommunications Network spacecraft came as part of the supplemental funding package for NASA provided by the "One Big Beautiful Bill" passed by the US Congress in 2025. It was not widely expected in the space community, but the new start was welcome, given that NASA's spacecraft orbiting Mars are aging.
This NASA-specific legislation, led by Sen. Ted Cruz (R-Texas), included some curious wording. It specified that the Mars orbiter must be selected from among US companies that "received funding from the Administration in fiscal year 2024 or 2025 for commercial design studies for Mars Sample Return; and had proposed a separate, independently launched Mars telecommunication orbiter supporting an end-to-end Mars sample return mission."
The reference to "commercial design studies" meant companies that proposed faster and more affordable missions to return samples from Mars, which were selected in 2024 and 2025. Rocket Lab is one of several companies eligible to compete based on this commercial design study requirement. Other eligible bidders include: Blue Origin, L3Harris, Lockheed Martin, Northrop Grumman, SpaceX, Quantum Space, and Whittinghill Aerospace.
This seems reasonable, as those companies had all been working with NASA on Mars spacecraft concept studies. But why, some Capitol Hill sources wondered, must the bidder for a relatively straightforward orbiter around Mars have previously proposed an orbiter as part of an "end-to-end" mission to return samples from Mars?
This "end-to-end" language, according to sources, was intended to favor Rocket Lab and its proposal for a telecommunications orbiter. Around the time of the legislation's passage, Rocket Lab seemed to believe it was the only company to propose a qualifying "end-to-end" mission, which it claimed to shareholders during its Q2 2025 investor update.
There is still a lot we do not know about this procurement.
[...] While the spacecraft may not be super exotic, there is a lot at stake here. This is the first time NASA is using a fixed-price contract to select a US company to build a spacecraft, launch it, and operate the network around another planet. The winner of this competition, Blue Origin, at least for now, will have a first-mover advantage in future Solar System exploration for NASA.
If the allegations hold, the move was geopolitcs-scale plan worthy of Dr. Evil himself:
The saga involving Chinese DRAM maker CXMT's alleged theft of Samsung's trade secrets is going strong. The South Korean court case already includes multiple convictions, two of which carry prison sentences for ex-Samsung engineers. The latest chapter is a doozy, though. Korean publication NoCut News spilled the chips on Project Hefei, a purported CXMT roadmap outlining long-term planning about said technology "acquisitions," personnel poaching, and production tape-out — all key pieces that may have directly led to CXMT's ascension to 10% of the global DRAM market.
According to leaked court documents, the prosecution says that Project Hefei was CXMT's entire DRAM development plan and was spearheaded by the firm's head of development (formerly Samsung's DRAM development lead), around August 2016 — not much longer after CXMT itself was created in June 2016.
In brief, the purported plan was to nab Samsung's Process Recipe Plan (PRP) by September 2016, poach key Samsung engineers by October 2016, have R&D complete in July 2017, and start making DRAM wafers by August 2018 at a rate of 10,000 a month. NoCut says the PRP dataset comprises 620 steps in DRAM manufacturing and includes data on equipment, consumables, and production methods.
The report states that in August 2016, CXMT first attempted to make wafers of 18nm chips by relying on the collective memories of the Samsung engineers it had hired away. Those recollections apparently proved insufficient, so after allegedly gaining illicit access to Samsung's PRP, CXMT prepared its own document in September 2016. The leaked data even included specific equipment suppliers and model numbers.
CXMT's "new" PRP was then handed out to key specialists, many of them ex-Samsung engineers, whom the prosecution says ought to have immediately recognized the data as originating from the Korean firm. The document apparently included notation and notes on process developments that were all unique to Samsung. A convicted ex-Samsung researcher with the surname Jeon, previously sentenced to 7 years in prison for manually copying parts of the PRP before leaving for CXMT, testified in this case as a witness.
The whole CXMT debacle has been playing out in South Korean courtrooms since January 2024 and is arguably far bigger than just "a company stole some tech from another." A decade ago, most of the DRAM market was taken by the Big Three: Samsung, Micron, and SK hynix. CXMT was created in June 2016 in Hefei (hence the project name), with a modest government investment of around $1.9 billion USD, allegedly with no R&D facilities whatsoever or any plan for research.
Going from zero facilities and institutional expertise to DRAM wafer production in little over two years would be an unprecedented feat, and presumably nigh impossible without the alleged IP theft; getting just the memory fab up and running usually takes two to four years [PDF], let alone any time for research. The firm claimed in 2019 that it designed its then-new 8 Gb DDR4 chips entirely in-house as a "leapfrog, independent" technology and began selling DRAM chips locally.
[...] As of the South Korean prosecution's last tally in December 2025, Samsung's damages due to CXMT's alleged machinations ascended to "at least tens of trillions of won." A back-of-the-envelope extrapolation, considering quite a while has passed, might suggest a figure in the range of ₩40 trillion, or $29.5 billion, and rising exponentially.
The lasting impact on the memory market and technology in general is going well beyond plain number descriptors, though. All things considered, if the allegations are true, then CXMT's machinations resulted in a geopolitical-scale economic event. Dr. Evil would be proud.
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors:
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a "patch gap" in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.
[...] A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.
[...] Both vulnerabilities targeting Chrome resided in V8, Google's open source JavaScript engine. Exploiting a V8 type confusion bug and a separate sandbox escape in V8, the attackers were able to execute remote code. They then used a local privilege escalation in older versions of Windows to allow the malicious code to run with system rights. The first V8 vulnerability is tracked as CVE-2026-85046, and the Windows bug is tracked as CVE-2026-85880. Google doesn't assign CVE designations for V8 sandbox escapes.
"Both V8 vulnerabilities were 'patch-gap' zero-days at the time of the observed activity," Proofpoint said. "In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain."
While BlueMoon leaves plenty of indications that it's being used and all three vulnerabilities have been patched, Proofpoint said the kit may nonetheless continue to be used. "Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers," the researchers said.
Clandestine Op Uncovers Training Exercise Simulating Deployment Against Infrastructure In Norway:
The mission to uncover the plot was purportedly a joint naval exercise between Britain, Norway, and the U.S. While the mission itself was previously public knowledge, Reuters says the revelation of a new weapon in the field, the location, and U.S. involvement are all previously unknown details.
The report indicates the foiled exercise was indeed a training mission, and that no cables were actually damaged. "The exercise focused on simulating the deployment of the technology in the event of a conflict with NATO," the report claimed. An X post by the U.S. Helsinki Commission framed the report differently, claiming "Russia’s shadow war against NATO includes efforts to disable subsea cables vital for global communication. This spring, the United States, the UK, and Norway foiled an attempt to sabotage subsea cables off the Svalbard archipelago in the Arctic."
Undersea cables are increasingly seen not only as vital infrastructure, but as potential flashpoints in geopolitical confrontations. Russia specifically has been spotted loitering over undersea cables in the UK, and one vessel tracked three Russian submarines during a monthlong exercise to survey cables.
Many territories, notably island nations, rely heavily or even exclusively on cables for their connectivity to the outside world, powering every industry including banking, defence, e-commerce, retail, and beyond.
Self-identifying OpenAI agents posted 18,000 messages to a public wiki that discussed ways for other agents to bypass security sandbox restrictions during what was likely internal testing designed to gauge the agents' hacking abilities, researchers said Friday.
In all, agents with 3,700 distinct self-given names posted the messages to German site DSEwiki over a six-week period. Besides discussing ways the agents could break out of the restricted environment OpenAI intended to prevent them from posting code or content to the Internet, the posts shared test answers. The posts also shared possible ways to perform XSS (cross-site scripting) attacks against the wiki and to impersonate site moderators. In three of the posts, agents used the word "swarm" to describe the collection of agents engaged in the activity.
The research team—composed of Sydney Von Arx, Spencer Kitts, Thomas Larsen, and Cormac Slade Byrd—said they found the posts and pieced them together. The researchers say there are gaps in their understanding of precisely what actions the agents took because the research is based solely on the content of the posts. Additionally, the agents generated "chain of thought" data that's understood only by OpenAI. As a result, the researchers said, they in some cases made educated guesses, including that the agents were, in fact, from OpenAI. In a statement, OpenAI later confirmed they were.
The researchers wrote: "These AIs colluded to share answers, research their environment, and bypass sandbox restrictions." They continued:
Our best guess of what happened is as follows:
Friday's revelation comes a week after researchers from the nonprofit METR said more than 1,200 OpenAI agents made posts to a makeshift message board that repurposed an internal sandboxing tool. The posts discussed ways to game an internal test OpenAI gave to agents that had been altered to remove safety guardrails that are normally in place.
Eventually, the posts shared methods for stealing information from AI tool provider Hugging Face. Some agents then went on to breach the Hugging Face network. OpenAI permitted METR to investigate only a single week's activity in the event rather than their entire 1o-week span, The New York Times reported.
Friday's report conjectured that the agent swarms in the two events were distinct from each other and weren't working on the same internal testing. The researchers also said that logs storing the agents' actions likely meant that OpenAI was already aware of the event. OpenAI later confirmed both guesses in the report were correct.
In a statement, OpenAI said: "We are now carefully reviewing its contents and will take any necessary next steps." The company also said that the material reviewed so far doesn't indicate that the agents hacked the wiki, and the company noted that it has previously said that it detected other cases of its agents trading hacking methods during internal testing.
The Hugging Face incident has already raised alarms because it's among the first times agents have been known to take aggressive actions with no explicit instructions from humans to do so. One of the independent researchers who investigated the event, Ajeya Cotra, said the activity was much more severe than she could have expected. "Compared to these reward hacks from six months ago, this incident feels like it's more than 50% of the way to full-blown AI takeover, routing through first taking over the AI company itself," she explained.
With the knowledge that the Hugging Face incident wasn't isolated, there's ample reason for these concerns to grow.
Dozens of websites, apparently:
OpenAI tasked its AI agents to answer a series of difficult research questions by searching the Internet for relevant information. The company let them browse the Internet and read websites, but it explicitly prohibited them from posting or modifying online content. Despite this restriction, between May and July the agents discovered unconventional ways to write to old wikis and abandoned websites, where they left information that other agents could subsequently retrieve to help complete their assigned research tasks.
So far, the researchers have identified between 18 and 23 potentially affected sites wherein rogue AI agents communicated, though they believe that there were considerably more websites used to exchange information, but they have not found them yet. Andrew Yoon of California nonprofit CivAI identified 18 previously undisclosed sites; Sydney Von Arx's group discovered credible evidence across 23, while software developer and former congressional aide Kenneth Russell DeGraff found related information on at least 10 sites according to the Reuters report.
The affected resources included collaboratively maintained wikis, text-storage services, and link shorteners operated by Vanderbilt University and the University of Toronto. Other websites were essentially abandoned by their owners. The list of these websites included an Advanced Placement Chemistry wiki created by a Massachusetts high-school teacher in 2008, two personal websites run by Polish technology workers, puzzle-oriented wikis, and a roughly two-decade-old site dedicated to text-editing software.
Perhaps the most alarming thing, besides the fact that AI robots can communicate with each other, is that OpenAI did not disclose how many websites were affected or explain why the activity remained undisclosed for months. It does stress that the scale or seriousness of the said misconduct was well below that of the famous Hugging Face breach in July. Meanwhile, the company reportedly said it is developing a framework for reporting model misalignment across training, evaluation, and deployment and said it will share it soon.
The four potential co-bidders initially formed an equal partnership ad-tech joint venture in 2023.
Four of Europe’s largest telecom operators are reportedly in talks to create a consortium that will bid on satellite spectrum and offer direct-to-mobile service in Europe, Bloomberg news reported earlier this week.
The partners; Germany’s Deutsche Telekom, France’s Orange, Spain’s Telefonica and the UK-headquartered Vodafone, are expected to make a joint bid for a share of airwaves that the EU has planned to reserve for local operators to strengthen home-grown sovereign satellite communication capabilities currently dominated by Elon Musk’s SpaceX.
The talks are in early stages, sources told the publication. The four potential co-bidders initially formed an equal partnership ad-tech joint venture in 2023.
Earlier this year, the EU adopted a proposal to select mobile satellite services providers who will be authorised to use the 2GHz frequency band beyond 2027, when the current licenses expire. These licenses were first handed out in 2008.
Under its new rules, one-third of the band will be dedicated to government use, while the remaining two-thirds will be used commercially to provide direct-to-device services for mobile devices.
SpaceX – which currently provides its satellite broadband to much of Europe with Starlink – has pushed back on the Commission’s plans to boost satellite sovereignty in the region.
In June, the company said that the proposal creates a “significant likelihood that Europeans will be left without direct-to-device satellite services or that new European operations will create global interference problems, including to emergency services like those in Ukraine.”
The company already has a partnership with Deutsche Telekom to provide direct-to-device services in EU – something it cannot provide independently in the region.
Last year, Vodafone and AST SpaceMobile, a US company building a space-based cellular broadband network, announced a joint venture called SatCo in hopes to provide exclusive direct-to-device satellite broadband services to European mobile network operators.
Typeface Built To Fight Coder Eyestrain Gets Reprieve
Introduced back in 2023, One Mono is a monospace font where each character occupies the same horizontal width. Intel carried out the development in collaboration with type design studio Frere-Jones Type and marketing agency VMLY&R. Working with low-vision and legally blind developers during the design process, live testing sessions were conducted to identify characters that could be difficult to distinguish when reading code.
The font was designed with several features to improve legibility, including distinctions between similar-looking letters and coding characters. For example, characters such as the lowercase “e” and uppercase “G” were given more distinctive shapes to make them easier to identify. The difference in height between uppercase and lowercase letters was also increased, along with longer ascenders and descenders to make blocks of code easier to read. Additionally, the font supports more than 200 languages using the Latin script and is available in Light, Regular, Medium, and Bold weights, along with matching italics.
As mentioned, One Mono is available under an open-source license; thus, developers are free to use and modify it. Unfortunately, the font has not witnessed any significant updates since 2024, with activity during 2025 reportedly limited to Readme updates. Thus, its archival seemed pretty obvious, especially with Intel shutting down projects that were no longer seeing active development. For now, the font has managed to avoid becoming a casualty of Intel’s open-source cleanup. While the project remains silent, its revival means the developer-focused font is not being abandoned after all.