SoylentNews

"Arthur T Knackerbracket" writes:

Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses 'absolutely substandard'>/a>:

The European Commission has opened an investigation under the Digital Services Act into whether Booking.com is doing enough to stop fraudsters running scams, phishing and smishing on its platform.

Officials told The Register the probe, which opened Wednesday, covers a very large online platform (one with more than 45 million EU users) and has three strands.

The first is whether Booking.com is failing to prevent fraudulent and non-compliant listings. "This is very much about people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner,"  an EC spokesperson said.

The second is whether it does enough to counter phishing and smishing (SMS phishing), and social engineering. "Scammers take over the account of a property owner and... portray themselves as the property owner, but also take over the contact details," she said. "So they start sending messages that people need to pay additional amounts."

The Commission also suspects Booking.com is not sufficiently protecting the data of its consumers and business users.

The third strand is advertising transparency: whether the platform clearly distinguishes ads from organic results, and whether it is clear about boosted listings, where property owners pay for higher ranking.

Officials cited Booking.com's own admission in June 2024 of a 500-900 percent jump in travel scams over the previous 18 months. "What made us concerned is the very high figures," an official said.

In the Netherlands alone, more than 1,000 fraud notifications were made in the first part of 2026, causing damage of €82,000, a tenfold increase on the previous year. "This is a real problem, and this is only the Dutch element," the official said. "We have reports like that almost from all member states... So, we have clear elements where we find that the risk assessment was not sufficient, and as you know, the risk assessment is a key tool for us."

"Arthur T Knackerbracket" writes:

https://www.engadget.com/2292027/google-brings-gemini-personal-intelligence-to-android-auto/

At the start of the year, Google debuted Personal Intelligence, a Gemini feature that allows the chatbot to pull information from your other Google apps to generate more personalized responses. An expansion in March brought Personal Intelligence to free accounts after it was previously only available to Google AI Pro and Ultra subscribers. And now Google has begun rolling out the feature to Android Auto users.

In practice, the company says today's update will improve Gemini's reasoning capabilities in cars. It will also make the assistant capable of delivering more specific details as they relate to your questions and prompts. For example, if you're driving to the airport, Google suggests Gemini with Personal Intelligence will be able to answer questions like "what's my flight gate?" and "is my flight on time?" Provided you've linked your Gmail account, it can do all this without you needing to pull over to find a confirmation email.

More broadly, Google says Personal Intelligence makes it easier to interact with Gemini more naturally. For instance, if you need directions to your doctor's office, you can just say "take me to my doctor's appointment," instead of speaking a specific address. Recommendations are also improved. If you're in a new city, Google suggests you can ask for dinner spots along your driving route and Gemini will generate suggestions while factoring in preferences and restrictions, like if you're a vegetarian.

As before, enabling Personal Intelligence is optional, and you can turn it off at any point if you don't want Gemini pulling your data. You can also control what apps Gemini can access. Google is starting to roll out Personal Intelligence to Android Auto users globally starting today (with the exception of those living in Switzerland, the European Economic Area, UK and Nigeria). In the coming months, the company plans to bring the feature to cars with Google built-in too.

Original Submission

"mrpg" writes:

Senedd member says smart glasses help with speeches in the Senedd:

A Reform politician has said he was using smart glasses with an in-built autocue feature to help him make speeches in the Welsh Parliament.

Jason O'Connell said the technology had helped boost his confidence when speaking in the Senedd, and denied it risked misleading people into thinking he was speaking without notes.

"I'm delivering my words in the manner that I see fit," he told the BBC's Politics Wales programme .

But the Welsh Liberal Democrat leader called for the glasses to be banned from use in the Senedd, while a parliament spokesperson said a review was under way.

[...] The smart glasses have allowed O'Connell to make speeches by reading a digital script that appears on the lenses of his glasses.

The text scrolls as he speaks, and it can also be controlled via a ring on his finger.

The Member of the Senedd (MS) for the Pontypridd Cynon Merthyr constituency said he had been looking at ways to improve his oratory skills since being elected to the parliament in May.

He said: "One of the things I identified as a weakness of mine was that my head was down looking at my notes a lot, and I wanted to get away from that and these glasses enable me to do that."

"Arthur T Knackerbracket" writes:

https://arstechnica.com/space/2026/10/spacex-and-tesla-into-a-single-company-has-a-lot-of-merit-musk-says/

Elon Musk said Tuesday that he would like to see the consolidation of his business empire by formally merging his two largest companies, SpaceX and Tesla.

"Do I think it would be a good idea? Yes," Musk said of a potential merger. He was speaking during a question-and-answer period as part of SpaceX's third-quarter earnings call. Musk said, ultimately, it not his decision. "But at the end of the day the shareholders have to be supportive of this."

Musk's talk of a merger comes after a busy year in which SpaceX already acquired Musk's artificial intelligence firm, xAI, in February. In June, SpaceX went public with the largest initial public offering on record.

At the request of shareholders of each company, Musk said both SpaceX and Tesla have formed special committees of "independent directors" to discuss the idea of a merger. "I'm a conflicted party; I can't actually be in the discussions of the special committees," Musk said. Those committees have not reached an agreement on the terms of a merger transaction, Musk said.

"Obviously there's no guarantee that they will, but I do think there's a lot of merit to combining the companies as we are pretty much in the superintelligence singularity," Musk said. "There's lots to be gained from cooperating on developing superintelligence software, chip design, the Terafab, obviously robotics, mass to orbit with the Starmind constellation, and connectivity. So I think it would be a good idea."

It might seem like madness to merge a space business with an automotive business, but both SpaceX and Tesla are rapidly transitioning from their original markets into artificial intelligence.

In its public financial documents, SpaceX has indicated that the bulk of its future revenues are likely to come from orbital data centers that will provide the backbone of computing for artificial intelligence on Earth. Tesla sees its future in sophisticated self-driving cars, robots, and industrial hardware. Both enterprises would require advanced computer chips and energy. SpaceX could provide the connectivity for Tesla hardware.

Beyond these synergies, the merger would be attractive to Musk—already the world's richest person and first trillionaire—because it would give him more control.

Based on SpaceX documents filed as part of its IPO, Musk holds more than 82 percent of voting power in SpaceX. In contrast, Musk holds about 20 percent of voting power at Tesla. By merging SpaceX with Tesla, where he has less direct control, Musk could acquire a majority of shares eligible for voting at the combined company. This would depend on the nature of valuations and negotiated agreements at the time of the merger. At the time of Musk's announcement, SpaceX and Tesla had market valuations of about $2 trillion and $1.5 trillion, respectively.

The merger will face scrutiny by US regulators. Additionally, Morningstar reported earlier this year that valuation disagreements will likely be significant, especially among Tesla shareholders. Musk said Tuesday that 50 percent of all Tesla shareholders, not just those with voting shares, would have to approve of the merger. Such a vote would only come if the two special committees reached an agreement on merger terms.

Some political leaders, already wary of Musk's outsized power and influence and willingness to use both freely, may also object to a single Musk mega-corporation.

It's not definitive what the merger's implications are for SpaceX's traditional space business and its longtime goal of settling Mars, or for Tesla's one-time aspirations to bring electric vehicles to the global market. Most probably, however, a combined Musk-universe would focus on artificial intelligence and the computing power needed to back those ambitions. Less Mars and cars—and more silicon.

Original Submission

"Arthur T Knackerbracket" writes:

https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312

Tragically simple private keys used by a certification authority based in India have been compromised, meaning the 60-million-plus certs it has issued can't be trusted and necessitating a massive clean-up job.

The CA of concern in this case is called eMudhra, which boasts of having issued over 60 million digital certificates to help usher in a world of digital trust.

The company has instead panicked the world.

News of the company's errors appeared on Tuesday in a post by Dennis Jackson, a member of Mozilla's cryptography engineering team.

"On Saturday, October 17, at 20:06 UTC, Mozilla received a report from a community member that private keys associated with eight eMudhra intermediate certificates had been compromised," he wrote. "These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control."

Or as Cloudflare put it, "an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic."

Jackson has since elaborated on the incident and the response, which has thankfully seen Mozilla, Chrome, and Apple remediate the issue so their browsers won't rely on the certificates – at least after users install an update. He also reports that eMudhra has revoked the certs, and lists many FOSS projects that have issued updates that mean they won't recognize certs from eMudhra.

That's welcome, but sadly certs signed with these private keys are still out there and many services rely on them. Browser makers are set up to detect and reject bad certs. Others who relied on them may not be, and will likely need to dig into their environments to see if they rely on certs signed by eMudhra. Developer Geoffrey Huntley has offered some advice on automating that process.

At the time of writing, eMudhra has not responded to The Register's inquiries about the incident and its security practices.

The latter question is of great interest because security researcher Scott Helmeanalyzed eMudhra's certs and found one the private keys it used "is the number 4."

"Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second," Helme wrote.

Other researchers have found private keys including the numbers 66, 155, 156, 230 and 237.

Those are vastly inadequate keys, because they're easy to guess, making all certs issued by eMudhra susceptible to brute force attacks.

As Helme put it: "A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵), so nobody is ever going to search that."

Original Submission

owl writes:

https://www.techdirt.com/2026/10/20/accident-or-not-the-no-kings-takedown-is-why-you-shouldnt-rent-your-megaphone-from-zuck/

This past weekend was the latest in an ongoing series of (massive) "No Kings" protests held around the country (and in some cases around the globe). The latest one was part of a "get out the (early) vote" campaign to make sure people are voting in the upcoming midterm elections. And, in the middle of it, suddenly it was reported that the No Kings Instagram account was suspended for about an hour, with admin access locked out for a few more hours. Many supporters of the protests immediately suspected foul play, highlighting that Mark Zuckerberg has gone in hard in supporting Trump over the past couple of years. So, the implication was that Zuck must be fiddling the dials to help the guy he supports in the White House. For a variety of reasons, this is unlikely to be true.

I'll explain some of those reasons towards the end of this article just to be thorough, but the point of this article is to highlight the argument that Will Robinson and Tim Chambers recently made in response to this, which is that it doesn't even matter if it was done on purpose or not. Even if you believe that Zuckerberg and Trump were laughing their heads off and jointly pressing the button to silence the No Kings account, the real problem was that this was possible in the first place.

Our response should be the same either way.

Original Submission

hubie writes:

Scientists are battling over whether supposedly simple organisms should be considered 'intelligent'. The outcome could reshape our understanding of the natural world – and our own place within it:

Forty years ago, as an undergraduate in Hokkaido, Toshiyuki Nakagaki came upon a lemon-yellow stain in a petri dish. That encounter turned him into a doyen of slime mould research – and fed a storm of biological and philosophical debate about the meanings of life and intelligence that persists to this day. Before, no one would have called a slime mould "intelligent"; the popular adjective, in fact, was "simple". "A simple mass of protoplasm," one 1895 description ran; "among the most simple of organisms", said another. And it was hard to argue otherwise. A slime mould can appear to be just a small cell, capable only of feeding and reproducing. Simple is as simple does.

Of that first meeting, Nakagaki said: "I was just impressed with how fast it moved." Physarum polycephalum, the slime mould species in that petri dish, has a top speed of 1cm an hour. For amoebic organisms, that's gold-medal standard. At first glance, Physarum seems to spread as irregularly as ink on blotting paper, but in fact it senses its meals of bacteria or other microbes and reaches for them with a long, thin finger of protoplasm – which not only digests its food but then forages further or pulls back into the rest of the mould. It's impossible to watch a slime mould over many days without sensing some deliberation at play.

Physarum is often found as a glistening patch creeping over leaf litter in forests; hence its nickname: "dog vomit mould". Even at its most expansive, occupying a couple of square metres, it is a single cell containing many nuclei – the tiny microdots holding its DNA. (Technically, this kind of structure is called a "syncytium".) The fact that you can see it with the naked eye, and even perceive the swells and contractions of the protoplasm within, makes it ideal for experiments. So Nakagaki got to work.

In 2000, his astonishing research began to surface in the media. "Slime mould solves maze puzzle," one headline ran, summarising an experiment in which Nakagaki induced a Physarum to find the shortest route through a maze in search of food. (In labs, slime moulds are reared on oat flakes, a convenient diet that can double as a researcher's breakfast.) In 2010, the New York Times wrote about Nakagaki's most famous experiment – the canonical study that scientists offhandedly call "the Tokyo railway one". Nakagaki placed oat flakes to resemble the map of Tokyo and 35 of its satellite towns. Then he let the Physarum loose from the centre of "Tokyo". From that one metropolitan oat, the mould spread outwards seeking the others, stretching towards them with its tubules. Then, putting out more branches, it linked up with itself, from one suburban oat flake to the next.

In doing all this, the mould displayed such a verve for efficiency – no wasted motion, an optimal pursuit of its food – that it ended up nearly retracing the route map of the greater Tokyo area's railway system. Nearly, Nakagaki said – because, in fact, free of human bias or politicking, Physarum may have improved the design of the network. Later, when Nakagaki twice won the Ig Nobel – the prize for research that is both amusing and thought-provoking – the first award cited his maze paper in the field of "cognitive science", but the second, cheekily, hailed the Tokyo railway study as a breakthrough in "transportation planning".

"Arthur T Knackerbracket" writes:

https://www.theregister.com/os-platforms/2026/10/21/openbsd-80-beefs-up-virtual-machines-and-gets-a-taste-of-wine/5304430

OpenBSD 8.0 brings bigger virtual machines, graphics improvements, and another helping of AI mockery. The round version number doesn't signal a radical break with its predecessors.

OpenBSD 8.0 is the 61st release of the project. Developer Bryan Steele posted a highlights rundown on Mastodon. Wireless improvements include updates to the qwx driver for Qualcomm Wi-Fi 6 hardware. Its VMM/VMD hypervisor now supports multiprocessor VMs with up to 64 virtual CPUs in each guest.

The kernel virtual memory address space on x86-64 is now 512 GB, up from 4 GB, allowing for GPUs with large amounts of VRAM. On Arm64 machines, OpenBSD supports hibernation, and on both x86-64 and Arm64 it can use CPU AES instructions for faster encrypted swap.

Component upgrades include OpenSSH 10.6 and LibreSSL 4.4.0, and the DRM graphics driver stack from Linux 6.18. The default C compiler is Clang/LLVM 22, including for the SPARC64 edition – but at the cost of dropping support for the Loongson architecture.

The list of errata is short, with just four fixes – but then, version 8.0 is very new. Just days before this release, there was a high-profile OpenBSD issue: Calif's "Big Fish" research describes a decades-old shared-memory bug chained with a separate kernel flaw to gain local root access. Both were fixed in OpenBSD 7.9, through errata 026 and 018 respectively.

Project leader Theo de Raadt forked OpenBSD from NetBSD 1.0 in 1995, and the first release of the new OS was OpenBSD 1.2 in July 1996 – so version 8.0 is as close as the project will get to a 30th anniversary release. According to Calif's proof-of-concept code on GitHub, the bug was in the original code that both OpenBSD and NetBSD inherited from the original BSD codebase – which is how come there's a 37-year-old bug in a 30-year-old project. A HackerNews comment says: "Interestingly, looks like this was accidentally fixed in NetBSD during a rewrite of that code in August of 1999."

The project has not updated its infamous slogan. The homepage still proclaims: "Only two remote holes in the default install, in a heck of a long time!"

As we noted in May when OpenBSD 7.9 appeared, the project rejects code generated by LLMs, although on the basis of licensing concerns rather than its cousin NetBSD's explicit anti-AI stance. As we reported recently, this strict anti-AI stance seems to be serving NetBSD well.

OpenBSD is also an anti-AI project, and for this release, the website goes out of its way to make that very clear. OpenBSD's mascot is a pufferfish, and in the banner artwork for the new release, "Puffy" has an extra eye – and the signpost in the image's background also has malformed text, a hallmark of early image-generation bots. The eyes are also constantly blinking – one at a time – to emphasize that this is a reference to Blinky the mutant fish from The Simpsons. In case you missed The Simpsons reference, the version 8.0 release theme song makes it even more explicit: it's titled "The Simps on AI." The lyrics and the vocals parody both Simpsons characters and AI users. Our favorite line sounds like Grampa Simpson, and says:

We've seen negative reactions online, but then we often find that some people lack much of a sense of humor. For our part, we really enjoyed seeing the OpenBSD team having such fun. We reckon it will appeal to many Butlerian Jihadi types. It certainly did to The Reg FOSS desk.

A couple of days before the 8.0 release came an unexpected announcement on the openbsd-ports mailing list: a proposed port of Wine for OpenBSD.

This is a new version of the Wine 11 runtime that allows Windows binaries to launch and run on OpenBSD. This is a 64-bit version of Wine for OpenBSD on x86-64, and for now, this means it can only run 64-bit Windows code.

"Arthur T Knackerbracket" writes:

https://www.theregister.com/systems/2026/10/20/tens-of-thousands-of-nvidia-gpus-sit-idle-in-metas-prometheus-supercluster-just-waiting-for-a-failure/5304269

More than 11 percent of the GPUs at Meta's Prometheus supercluster in New Albany, Ohio, are either dead or sitting idle waiting to step in when the next drops out, Zuckercorp revealed this week.

The massive pool of redundant GPUs is just one of several measures the hyperscaler has taken to keep its AI training runs on track.

Prometheus is among Meta's largest compute deployments to date. Powered by Nvidia's Grace Blackwell and (soon) Vera Rubin rack systems, Meta says the supercluster will eventually scale to a gigawatt of capacity spanning about a million accelerators.

But as anyone who has worked on a large scale compute cluster understands, whether for LLM training or traditional HPC workloads, more chips inevitably means more problems.

In an eight-GPU node, the chance of having a GPU fail is relatively low. In a 100,000-GPU cluster, failures are unavoidable. Meta is building something that's 10x larger and requires distributed training runs across multiple datacenters. Keeping the entire thing humming long enough to reach the next checkpoint becomes a major headache.

In a blog post published this week, Meta offered a unique look at the work it's done to keep failures from derailing the development of models like Muse Spark or its most recent release Muse Wonder.

When Meta began the first phase of its Prometheus deployment in New Albany, the company says, it was experiencing roughly 1,000 interruptions per day for every 8,000 GPUs.

Interruptions don't mean GPU failure. They simply mean something crashed, failed, or timed out, forcing the training run to stop and roll back to the last known good checkpoint.

Meta claims in the year since it's been able to cut down the number of interruptions by 99 percent, to about 11 per day per 8,000 GPUs.

One of the ways it's done this is by keeping some of Prometheus' GPUs in reserve. The cluster is currently powered by a combination of GB200 and GB300 systems, each with 72 GPUs per NVLink domain. However, only 64 of them are ever in use at any given moment. The other eight are essentially hot spares.

Meta did this because a single failed GPU would take out an entire rack and interrupt the training run. Now, when a GPU fails, one of the spares can slot in and take its place. While this saves time — Meta doesn't have to drop the entire rack from the cluster or wait for someone to swap the faulty component to start training again — a failed GPU would still result in an interruption, albeit a shorter one.

To mitigate this, Meta took advantage of the fact that large scale training jobs usually use data parallelism, where multiple copies of the model are resident within the cluster.

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn't find among Switzerland2's authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Ultimately, 333 exit relays were involved in the SSH and email interception campaign, although investigators haven't established how the attackers gained control of all the underlying servers. The attackers then reconfigured the servers. One set of changes redirected SSH traffic traversing Tor to one of 12 attacker-controlled interceptor servers. Tor users who ignored warnings that the SSH host key had changed would then enter their SSH passwords.

A second set of changes caused the exit nodes to block ports 25, 465, 587, 993 and 995—used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections, the attackers used their access to the exit nodes to obtain unencrypted messages. It's unclear whether any such downgrade attempts succeeded. The hijacking occurred from October 2 to October 5.

Tor volunteers partially outlined the initial compromise of the management server and Switzerland2 and the attempt to intercept unencrypted email. Tuesday's report revealed many new details, including how many exit nodes were compromised and how the attackers used them to redirect SSH traffic.

"If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won't notice anything at first," Kaba, the name of the Tor volunteer who authored the post, wrote. "Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you're unknowingly redirected to one of 12 SSH interception servers. That's exactly what happened to me on Friday morning." Kaba then received the following warning:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
Please contact your system administrator.

The volunteer investigated further and found that when people ignored the warning, the attacker (1) stole the SSH password, (2) opened a connection to the server and observed all typed commands, and (3) opened a second connection and infected the server with Ebury.

To investigate the campaign, Kaba created a script that polled all of Tor's roughly 3,000 exit nodes to check whether they received a correct SSH fingerprint from a test server. The test server then checked whether the connection came from a pinned exit node or one of 12 SSH interception servers used by the attacker. The volunteer further set up a honeypot to observe the interception software attempting to log in and install Ebury.

Several mysteries remain. Tor volunteers still don't know how the attackers accessed so many servers. One possibility is that a company hosting them was hacked, but the theory is inconclusive. Another open question is who is behind the attack. "The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group," Kaba wrote. "Though this too is just speculation."

A last perplexing finding: why did Switzerland2 accept an RSA key when there's no evidence it was an authorized SSH certificate?

The takeaway from the event is the crucial role defense in depth plays in preventing data theft in mass hacks like this one. Those measures include configuring email accounts to accept only encrypted traffic and reject unencrypted ports. Another is to disable password authentication in favor of SSH keys.

hubie writes:

Simple food components may provide the key to new cost-effective materials that will benefit chronic wound healing:

A team from Flinders University's Biomedical Nanoengineering Laboratory has found that vanillin has pronounced antioxidant, anti-inflammatory and antibacterial properties, making it a good candidate for wound-healing formulations.

Vanillin is the primary chemical component extracted from natural vanilla pods, but is a compound that can also be synthetically produced from clove oil or rice. Apart from being a sensory additive – used as a key ingredient in many foods for its sweet aroma and flavour – vanillin is also a functional molecule, serving as a dynamic crosslinker and functional element in material design.

By placing vanillin within a food-to-function framework, the researchers have linked its chemical properties to biological activity and potential biomedical applications.

"Vanillin is among the most widely used flavour compounds in the global food system, valued for its sensory attributes, chemical stability and long history of safety – and that can be transferred to other areas, such as medical uses," says Professor Krasimir Vasilev, Professor of Biomedical Nanotechnology at Flinders University and Director of Flinders' Biomedical Nanoengineering Laboratory.

"Because vanillin's synthetic form is abundant and cost-effective, we believe vanillin-based formulations may offer safe and multifunctional solutions for ulcer treatment and targeted drug delivery, especially of hydrophobic compounds.

"Owing to its amphiphilic molecular structure, vanillin can interact with reactive oxygen species, cellular membranes and polymeric matrices, providing a basis for its incorporation into functional formulations."

This study continues explorations by Flinders researchers into other foods that can provide medical benefits – including using peppermint oil in a versatile new medical coating, which was published by Small journal in February 2026. For this, the Flinders team created a nanoscale peppermint‑oil derived coating that protects against infection, inflammation and oxidative stress, while remaining compatible with human tissue and suitable for medical materials.

The idea for this thread of food-based research emerged after Professor Vasilev noticed that eating peppermint leaves from his drink significantly relieved his sore throat, inspiring him to explore whether its bioactivity could be converted into a durable coating using plasma technology – something he has been researching for more than two decades.

The Flinders researchers share similar enthusiasm for the new studies into vanillin – especially because the availability of vanillin as a low-cost small molecule that is compatible to good manufacturing offers a clear advantage for industrial scale-up, formulation reproducibility, and supply chain robustness.

Journal Reference: "Vanillin as a bioactive component in biomedical formulations for chronic wound healing and tissue regeneration", by Borislav Stoilov, Vi Khanh Truong, Christopher Delaney and Krasimir Vasilev, International Journal of Pharmaceutics. DOI: 10.1016/j.ijpharm.2026.127263

Original Submission

"Arthur T Knackerbracket" writes:

https://www.cnet.com/tech/services-and-software/php-vulnerabilities-web-hosting-cybersecurity-news/

An agency that monitors the programming language PHP issued a severe warning on Tuesday that it had identified two major cybersecurity vulnerabilities. Fixes should have been deployed on Wednesday at 10 a.m. ET, but security experts are urging website administrators to take immediate notice and precautions.

PHP is a free, open-source programming language that much of the web is built on. The warnings are unusually severe, rated 9.2 out of 10. While we don’t have many details about the specifics of the vulnerabilities yet, the concern is that the exploit could be used by bad actors to hack into websites. The vulnerabilities could affect 70% of the world’s websites, according to the Wall Street Journal. That’s why security agencies around the globe, including the US National Security Agency and the UK’s National Cyber Security Centre, are urging website administrators to install the updates or take their sites offline until they are able to patch them.

Cloudflare’s chief technology officer Dane Knecht said Wednesday morning that the company has deployed a fix to its firewall. Cybersecurity company watchTowr says it was able to successfully reproduce one of the exploits. “As expected, watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities,” Jake Knott, head of threat intelligence, said via email on Wednesday morning. “Whilst nobody has been successful to date, we don’t expect that will last long.”

OpenAI said in a blog post on Wednesday that the vulnerabilities in PHP were discovered by Calif, a self-described hacker team, using its AI model, GPT-5.6 Sol. Wiz, an AI cloud cybersecurity company, also independently identified the vulnerabilities, according to the ChatGPT maker.

Artificial intelligence has been a double-edged sword in cybersecurity, providing both cyber defenders and attackers with powerful tools. And AI companies know this, with OpenAI saying this incident “highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.” Companies like OpenAI and Anthropic have begun slow-rolling the release of their AI models to let cybersecurity experts to use them first to shore up their own defenses and identify any issues before a wider release.

But for everyday internet users like you and me, the concern is that while AI is great at spotting these bugs, it can take longer to get them patched. Even OpenAI says it “expect(s) similar findings to increase sharply in the coming months.”

Original Submission

"Arthur T Knackerbracket" writes:

Tech giant walks away from flagship Essex project as power connection delays threaten to leave nation's AI ambitions waiting until the 2030s:

Microsoft has reportedly pulled out of plans for Britain's largest AI supercomputer, because the government-backed project is facing the rather inconvenient problem of having no electricity to run it.

The tech giant has terminated its agreement with British AI infrastructure startup Nscale for a planned datacenter in Loughton, Essex, according to The Telegraph, which first reported the withdrawal on Sunday.

The decision follows reports that the site, which was supposed to begin operating in 2027, might not receive enough electricity from the grid until the early to mid-2030s.

Microsoft was expected to be the anchor customer at Loughton, which Nscale had pitched as the UK's largest sovereign AI datacenter. Its departure leaves Nscale without a publicly announced customer for the site, although the neocloud insists the project is still going ahead.

When the deal was announced in September 2025, the plan was to pack 23,040 Nvidia GB300 GPUs into a 50MW facility, with room to expand to 90MW. Microsoft would use the computing power for its Azure cloud services, with the first chips expected in early 2027.

One important detail remained: how to power it.

As The Guardian reported last month, UK Power Networks warned Nscale that the grid capacity needed might not be available until the 2030s.

[...] The project has already had its share of awkward moments. In March, it was revealed that the site earmarked for Britain's AI supercomputer was still being used as a scaffolding yard. Nscale has since cleared the land, but removing the scaffolding has proved easier than securing electricity.

The government might be feeling a little red-faced too, having trumpeted the Loughton project as part of Microsoft's £22 billion UK investment announcement in September 2025. Just over a year later, Microsoft has walked away, and the site is still facing years of delays in getting the power it needs.

The grid problems extend well beyond Essex. Ofgem proposed charging datacenter developers for connection requests earlier this year, hoping to discourage speculative projects from clogging up the queue. Demand for new connections had surged from 41GW to 125GW in less than a year, with datacenters accounting for at least 80GW.

[...] For all the billions being thrown at AI infrastructure, the industry is discovering that building datacenters is the easy part. Getting them connected to the grid, and keeping the neighbors happy, is proving rather more difficult.

Original Submission

arslan writes:

Anyone that has ran local LLMs would know that the size of the model is limited by your physical resource and typically the smaller the LLM the less productive it is. The prevailing option, without doing some work parallelisation, is to run larger LLMs locally is to increase resources, especially upgrading the GPU with bigger memory or if you're on a Mac with Unified Memory upgrade/swap for a bigger one.

Now, with Mac silicon, one can cluster a bunch of Macs with Thunderbolt 5 (TB5) and use their proprietary protocol RDMA over it, instead of IP over Thunderbolt, and get blazing speed, enough to treat the cluster like a cluster of Nvidia GPUs.

Check out the experiment done by this bloke where he setup a four-machine cluster to run trillion-parameter models locally at $50,000 versus $780,000+ for equivalent Nvidia H100 infrastructure.: https://www.sean-weldon.com/blog/2026-06-16-clustering-mac-studios-for-local-ai-apple-rdma-over-thunderbolt-5

Original Submission

"mrpg" writes:

An estimated speed of 1.6 meters per second roughly matches a person's brisk walking pace:

Four ancient footprints are helping scientists step into a T. rex's shoes.

The prints form the first set of tracks probably left behind by an adult Tyrannosaurus rex, researchers report September 8 in the Journal of Vertebrate Paleontology. Measurements of the 7-meter-long trackway suggest the ancient predator was ambling along at about 1.6 meters per second, roughly equivalent to a person's quick walking pace.

A few single adult T. rex footprints exist in the fossil record, as do trackways possibly from T. rex juveniles or other dinosaur species, says Peter Falkingham, a paleontologist at Liverpool John Moores University in England. "But an individual track doesn't tell you a lot. A trackway tells you more about foot placement as the animal's moving along." And younger and older dinosaurs probably walked differently, just as human toddlers and adults do.

[...] Slender toe impressions and fossils unearthed in the area signal a T. rex left behind the footprints roughly 66.5 million years ago. "There's always the possibility that we haven't found the skeletons of some species that we don't know about," Falkingham says. "But as far as our knowledge goes, T. rex is about the only track maker that could have made these."

The team used stride length and body size to calculate the dinosaur's speed. Unfortunately, the footprints aren't well-preserved and estimating speed from tracks is tricky, so the T. rex may have been walking slightly faster or slower than calculated. Better tracks could have revealed whether the foot landed flat or toe-to-heel, or how foot pads supported the predator's weight.

More tracks are sure to follow. In fact, a fifth step may be concealed in the hill. But the team is waiting for Mother Nature to wear away the surrounding rock, Hups says. "I can't wait to get back out there and keep looking for more."

Journal Reference: P.L. Falkingham et al. A large tridactyl trackway from the Upper Cretaceous Hell Creek Formation of North Dakota, likely attributable to an adult Tyrannosaurus rex. Journal of Vertebrate Paleontology. 2026. doi: 10.1080/02724634.2026.2706201

Original Submission