joshuark shares a report from BleepingComputer: Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet. Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP). "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," it said. "In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'" After releasing the October 2026 Patch Tuesday Windows 11 cumulative updates, Microsoft marked the bug as resolved, but in a Tuesday update it said the issues weren't actually addressed and that a fix would ship later. "This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated," it said in a service alert sent to IT admins. "A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion." While Microsoft continues working on a permanent solution, it shared a temporary fix that requires affected customers to choose one of two VPN tunneling protocols to work around the issue.

Read more of this story at Slashdot.

The Browser Company is shutting down its Arc browser on December 22 and encouraging users to migrate to Dia, its newer AI-powered browser for Apple Silicon Macs and Windows 11 PCs. Thurrott reports: In the message explaining why it was sunsetting Arc, The Browser Company explained that maintaining two separate browsers was difficult to justify, especially from a security perspective. "Dia was built from the ground up to meet today's security standards, so that's where our engineering and security teams will focus moving forward," the company wrote. The retirement of Arc will be gradual: While nothing changes for existing Arc users, it's no longer possible to create new Arc accounts as of today. On November 23, tab sync, Browse for Me, and other AI features will be disabled on the iOS and Android versions of Arc. Lastly, the desktop version of Arc will stop working on December 22, and Arc accounts will be deactivated.

Read more of this story at Slashdot.

Moderna shares plunged as much as 25% after partial clinical trial data leaked for its personalized cancer vaccine developed with Merck, despite the full results showing promising outcomes for melanoma patients. Analysts attribute the selloff largely to inflated investor expectations rather than disappointing clinical results. CNBC reports: The personalized vaccine, known as intismeran autogene, paired with Merck's immunotherapy Keytruda reduced the risk of recurrence or death in certain melanoma patients by 42% compared with Keytruda alone. The data also showed the shot along with Keytruda reduced the risk of cancer spreading to distant parts of the body or death by 38%, compared with just the immunotherapy. The companies say about 82% of patients who received the personalized cancer vaccine alongside Keytruda were alive without their melanoma returning at two years, compared with 70% of those who received Keytruda alone. [...] Investors see the targeted vaccine as a possible breakthrough treatment, with the potential to be used in other forms of cancer in the future. It could also offer Moderna a critical additional commercial product in its pipeline, following vaccines for Covid-19, the flu and respiratory syncytial virus. "We assert this relative reduction in recurrence/death is clinically meaningful," said BMO Capital Markets analyst Evan Seigerman. "Such a reaction likely reflects inflated expectations into the full data release, rather than a true indictment on the efficacy of the combo therapy." UBS analysts said "this is overall a strong data set" and gives more confidence in upcoming studies of the vaccine in kidney and bladder cancers. They added the stock reaction may be due more to massive expectations than disappointing data.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Wired: Longtime audio giant Bose announced on Wednesday that it's acquiring Skullcandy, the lifestyle brand known for its bass-heavy headphones. Skullcandy will remain a separate company within Bose's Premium Consumer Audio business and will still be based in Park City, Utah. The acquisition isn't out of left field. Bose has lent its audio expertise to Skullcandy over the past year under its Sound by Bose licensing program. Skullcandy designs the headphones and then works with Bose on the audio front. The relationship began with the Skullcandy Method 360 ANC earbuds in 2025 and more recently, with the Crusher 1080 ANC headphones in July. [...] This is hardly Bose's first audio acquisition (though it may be the most mainstream). Bose acquired McIntosh Group, owners of luxury audio brands McIntosh Laboratory and Sonus Faber, back in 2024. But Bose seems to be after Skullcandy's connection to its community. "What does the brand stand for? Does it have meaning for consumers? Is it relevant to a group of consumers that, frankly, we otherwise aren't reaching?" Bose CEO Lila Snyder tells WIRED. "If you think about McIntosh, Sonus Faber, and Skullcandy, they all fit into that realm. Skullcandy gives us access to a customer base that we think we're largely missing with the Bose brand." That's why Bose has no plans to relocate Skullcandy from Park City, Utah, which Snyder says is the epicenter of board sports culture. "We want to make sure we're right at the heart of it, as they always have been," she says. Skullcandy products are also affordable, especially compared to other Bose products and Bose-owned brands, which lets Bose compete at both ends of the market.

Read more of this story at Slashdot.

BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, "The PHP story feels like the cyber equivalent of an unexploded bomb -- I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet." Although no successful attacks have been confirmed, the AI-assisted discovery of long-hidden flaws has triggered a worldwide security scramble, with websites taken offline as a precaution and administrators racing to deploy patches before attackers can exploit the vulnerabilities. From the report: The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. [...] It was supposed to be kept quiet until everyone had a chance to fix their sites -- but the news was leaked. From that point the clock started ticking. As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. "There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out." But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success. "We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," Gina Neff, Professor of Responsible AI at Queen Mary University, told the Today Program on BBC Radio 4. "We have enormous capability to handle these risks."

Read more of this story at Slashdot.

Anthropic has launched Claude Duet, an AI agent aimed at professionals and small businesses that competes with Meta's Muse and OpenAI's Dots. Here's Anthropic's description of what it can do: Each morning, it sends you a short brief on the most important items across your connected apps. Throughout the day, it keeps tabs on those apps and messages you only when something needs your attention. You can also hand it tasks of all shapes -- from simple administrative tasks of scheduling meetings to more complex ones, such as building dashboards with dozens of tools, creating financial or sales forecasts, prototyping, and building web apps. The Verge reports: Claude Duet pulls in memory, skills, and connected apps from Claude, and it has a virtual machine with a browser that it can use for completing work. Before any big step, like sending a payment or deleting something, Claude Duet messages you for approval. Given that Duet may be taking action on sensitive information, it has a new "new dedicated classifier and safety system prompt" that are "designed to reject requests to share the strictest tier of information," such as credit card numbers. Anthropic says Claude Duet is currently an "early version" and that it "still might misread a thread or miscalibrate what's urgent." It's also not "as strong" at personal errands like booking tickets.

Read more of this story at Slashdot.

Trend Micro's Zero Day Initiative appears to have accidentally disclosed several unpatched Linux kernel vulnerabilities on the public LKML instead of the private security list, including two CVSS 9.0 flaws that could enable remote code execution through SMB Direct and KSMBD. "This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking about their submission to the public mailing list," adds Phoronix. The newly-disclosed vulnerabilities include: ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline. ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability. ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon. ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation. ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure. ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

Read more of this story at Slashdot.

An anonymous reader quotes a report from the BBC: Google is facing a backlash from some staff members over the company's deployment of its AI technology for military use. The BBC has spoken to several tech workers who have either recently resigned from Google's AI company, Google DeepMind, or are in the process of leaving, over concerns with the tech firm's military contracts. Sofia Liguori, a London-based research engineer, is one of them. She resigned from Google DeepMind this week and spoke about her concerns exclusively with the BBC, despite her contract restricting her from doing so. "Realizing my company is pushing more and more for AI systems in military operations makes me feel ashamed to work at Google," Liguori said, speaking in a personal capacity. [...] After working for the company for three years, Liguori said she decided to resign over Google's increasing work with the US and Israeli militaries. "I don't agree with this direction and this has led me to lose faith in my company being true to its stated ethical values," she said. Those values, according to Google's AI Principles, include implementing AI with "human oversight" and aligning the technology with "international law and human rights." But former and current staff at the company, and experts the BBC spoke to, said they were concerned about the level of human oversight at critical moments. The tech workers said they are particularly worried about the AI military deals signed this year, because they greatly increase the scope of what the Pentagon can use the technology for. Andreas Kirsch, an AI researcher, also resigned from Google DeepMind earlier this month over his concerns. Kirsch told the BBC that he believes "Google's governance and oversight are not sufficient or meaningful enough to deploy AI safely and responsibly in military and classified settings" or "to develop artificial superintelligence safely in the future." "Google seems to have no right to control or veto how the Pentagon uses its AI and also seems to have limited visibility into how it's being deployed," he added. [...] Employees at Google have told the BBC that staff are scared to speak out about AI safety and its uses in warfare because their employment contracts prohibit them from publicly criticizing the company. "In principle I'm not allowed to criticize Google for the duration of my life," Sofia Liguori told the BBC. But she decided to do so "because I believe it's important for these things to be known and I also think that talking about facts is not criticizing." Liguori added that at Google "people are scared of retaliation and putting their career at risk. You feel you are being watched, you can't speak." A current employee at Google DeepMind, who declined to be named for fear of retaliation, told the BBC that "a lot of motivated employees who signed up for [the company's] original mission could leave -- but there's also a pipeline of people at the start of the careers who could fill those positions. It could be a changing of the guard." Another Google DeepMind staff member, who also wished to remain anonymous, told the BBC: "A lot of people have left the company that feel strongly about this [how Google DeepMind has changed its ethics position]." "Some people are putting up a fight, others are thinking: 'it's a big company. What do you expect to change?'", the employee said. In response, a Google spokesperson told the BBC: "We work with public sector organisations worldwide and follow a consistent process for reviewing and entering these contracts, including compliance with our acceptable use policies and AI principles." "We also have dedicated channels for employees to safely raise any concerns -- ranging from business ethics to misconduct -- and have strict workplace policies in place to prevent retaliation of any kind."

Read more of this story at Slashdot.

Airbnb is banning hosts from requiring guests to perform time-consuming checkout chores, including washing dishes, stripping beds, doing laundry, and taking trash off-site. The updated policy applies to reservations booked on or after November 20. The Verge reports: Airbnb is displaying hosts' requests more prominently now in a new "rules and requests" section on listings. You might see an "includes cleaning requests" warning if a host leaves chore requests in their listing after the new policy goes into effect. Hosts aren't allowed to sneak in extra rules in messages to guests or on signs around their property, either. Some hosts pushed back on the house rules restrictions on Airbnb's forums, saying they pose health risks and arguing that guests can simply choose not to stay at listings with overly-strict rules. Airbnb says there can be exceptions to the limits on checkout chores, like asking guests to "dispose of trash in an animal-proof container in bear country."

Read more of this story at Slashdot.

Longtime Slashdot reader destinyland shares a report from CNN: The Pentagon has given the Department of Homeland Security permission to test a military-grade heat ray and develop tactics to potentially use it in operations at the southern US border, according to a memo signed by Defense Secretary Pete Hegseth last month and obtained by CNN. The heat ray, officially known as the Active Denial System, is a nonlethal weapon that shoots an invisible beam of electromagnetic waves that can reach a little more than half a mile away, according to the US military. The energy beam causes a burning sensation when it comes into contact with the human skin -- which Pentagon officials have previously compared to feeling a blast of heat when opening a hot oven. Military officials have said the resulting "tingling effect" lasts between 10 and 15 minutes but also generates "an instinctive and irresistible urge to run from the effect."

Read more of this story at Slashdot.

An anonymous reader quotes a report from The New York Times: For the first time, scientists say they have used viruses designed by artificial intelligence to treat a human patient. Researchers announced on Tuesday that they had administered the virus, known as a phage, to a patient suffering from a deadly bacterial infection. Phages attack bacteria, and the hope is that this one will kill the microbes causing the infection. Radical Numerics, the start-up that created the viruses, posted a technical report about them on its website. But the company declined to provide information about the patient or the doctors running the trial, citing confidentiality requirements. [...] In 2025, researchers at the Arc Institute in Palo Alto, Calif., created an A.I. model called Evo 2, which they trained on millions of DNA sequences, including phage genes. They prompted Evo 2 to make new genomes similar to those in a group of phage species. The A.I. generated 700,000 virus genomes. The team synthesized DNA molecules from 285 genomes and inserted them into bacteria. The researchers found that 16 of the genomes gave rise to viable viruses. Three members of the Evo team, including Dr. Nguyen, left to found Radical Numerics. In June, the company unveiled a new A.I. model, called Omnii, based on some of the same principles as Evo. Omnii can be trained not just on DNA but also on other aspects of biology, such as the structures of proteins and molecules that keep genes turned on or off. The company is now using Omnii to tackle a range of challenges, including designing cancer vaccines and recognizing the risk that a virus may cause a pandemic. Among these efforts is the first trial of A.I.-designed phage therapy. The researchers created variations of a phage called T7. The virus, which only infects E. coli, looks like a microscopic Apollo lunar lander: a ball-shaped protein shell that holds its DNA atop six leglike protrusions. To infect a bacterium, T7 lands on its surface, using its legs to anchor in place. It then injects its DNA into the cell. Omnii generated new viral genes altering the shapes of T7's legs, according to Dr. Nguyen and his colleagues. While some of the new legs were significantly different from natural ones, Omnii's phages could still infect bacteria. Once the researchers were confident their strategy had worked, they partnered with doctors treating a patient with a stubborn E. coli infection. The bacteria had resisted not just antibiotics but all the available phages. The researchers said they had trained Omnii with information about the resistant strain and told it to design T7 phages with legs that could grab onto the bacteria. Once the A.I. generated genomes for new viruses, the scientists said they produced the corresponding DNA molecules and inserted them in bacteria. The bacteria became infected and produced T7 phages that could successfully infect, and kill, other microbes. After running tests to make sure the phages were safe, Radical Numerics presented them to the doctors. The F.D.A. authorized a trial. While the trial was authorized by the FDA, it's worth noting that the research has not yet been peer-reviewed in a scientific journal and there's no guarantee the AI-designed phages will work. However, if it does prove successful, it could help speed phage therapy by cutting down the time it takes to create a new virus tailored to each patient's infection. "We think we can get it done in days," said Dr. Eric Nguyen, the chief executive officer of Radical Numerics.

Read more of this story at Slashdot.

eBay plans to cut about 1,000 jobs, or 9% of its workforce, as CEO Jamie Iannone moves to redirect resources toward the company's fastest-growing businesses. Reuters reports: The company had 12,300 employees at the end of last year. It also let go about 6% of its workforce, or 800 employees, in February as part of efforts to streamline operations. EBay has set itself apart from rivals by pushing into authenticated luxury goods, collectibles and refurbished products, which draw enthusiasts willing to pay more for valuable items. That has helped its shares rise nearly 40% this year, outperforming the benchmark S&P 500's around 12% gain. "Our strategy is working," Iannone said in the memo, adding that "continuing to capture the significant opportunity ahead requires us to make thoughtful choices about where we focus and invest." He said affected staff would be informed in the coming days.

Read more of this story at Slashdot.

AMD has published Linux kernel patches for an official Ryzen overclocking driver that allows users to adjust CPU power and current limits through a firmware interface exposed via sysfs. Phoronix reports: AMD engineer Shyam Sundar S K posted the patches for the AMD Overclocking "AOD" WMI driver as an interface to the platform firmware for managing overclocking and power/current limits of modern Ryzen CPUs. The driver in its initial form allows setting via sysfs a number of CPU tunables including the Package Power Tracking (PPT), Thermal Design Current (TDC), and Electrical Design Current (EDC) limits along with reading their supported range. SMT toggling can also be done via the interface as an alternative to the likes of Linux's "nosmt" option in disabling SMT at the platform level rather than kernel disabling. The current memory clocks can also be read via this AOD driver. The power tunables aren't applied in real-time but go into effect at next reboot. The firmware does support many more commands compared to the few initially wired up and hopefully in time more of these controls will be enabled with this driver.

Read more of this story at Slashdot.

A CBC investigation found that more than 1.5 million Canadian Crime Stoppers tips spanning 25 years were exposed in a breach of the P3 Global Intel tip-management platform. About 850,000 records contained personally identifiable information, including addresses, phone numbers, emails, license plates and some banking details. Longtime Slashdot reader doconnor shares the report: The data was stolen last March by hacktivist collective Internet Yiff Machine. In a manifesto, the group said it wanted to disprove the claim by P3 Global Intel -- the company hired by Crime Stoppers to manage its tips -- that the platform was "anonymous" and "secure." A copy of the hacked data was made available to researchers and journalists, including CBC, by Distributed Denial of Secrets, a U.S. non-profit that archives and publishes hacked and leaked documents it deems to be in the public interest. The report found that more than 4,300 Crime Stoppers tipsters identified themselves by their full name, with hundreds of records containing staff warnings that individuals had "self-identified" or been "exposed," yet their information remained unredacted. The leaked data included sensitive allegations involving murder, terrorism, drug trafficking and organized crime, with nearly 49,000 tips linked to cases cleared through arrests or criminal charges. Cybersecurity experts criticized the retention of decades-old records... "If a tip is closed, does that need to stay online?" asked cybersecurity expert Ben Coon. "The answer to that, to me, is no." The RCMP was initially told Canadian data was unaffected, then assured that exposed Canadian records contained no personally identifiable information. This appears to contradict the CBC's findings. Furthermore, affected individuals have not been systematically notified because contacting them could further jeopardize their anonymity. "For a system that has been designed to promise anonymity to the users, that has failed categorically," said Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: We haven't heard many details about Microsoft's upcoming "Project Helix" gaming hardware since the company announced it in March as a device that will "play your Xbox and PC games." In a new wide-ranging profile of Xbox CEO Asha Sharma, though, Fortune alludes to a dual release strategy for upcoming Microsoft gaming hardware, with "a next-generation handheld device" planned by the end of next year and a 2028 holiday season console release that could cost between $1,200 and $1,800. That future console price range is based on what has "internally been projected" at the company, according to Fortune. But the price for consumers could come down if "Microsoft decides to subsidize the cost," the outlet says, as many console makers have done in the past. While a $1,200 starting price would be historically high for the game console market, even accounting for inflation, it also reflects a new normal: The slowdown in Moore's Law and AI-driven component shortages mean cutting-edge gaming hardware just isn't as cheap as it used to be. This year, the Steam Machine broke the $1,000 starting price, while the 2-year-old technology in the PlayStation 5 Pro is now going for $900, and the 6-year-old Xbox Series X now starts at $750.

Read more of this story at Slashdot.

A New Mexico judge has ordered Meta to pay $25 billion after a jury found Facebook liable for deceiving users about privacy during the Cambridge Analytica scandal. State Attorney General Raul Torrez called it "one of the largest, if not the single largest state verdict against a company in American history." While Meta plans to appeal the ruling, the funds that are to be collected will go toward state education spending. The Associated Press reports: Jurors in September found Meta liable for over 43 million violations of New Mexico consumer protection laws when a political consulting firm, Cambridge Analytica, harvested Facebook user data to generate targeted political ads for the 2016 election. Forty-eight other states settled with Facebook in a nationwide case, but New Mexico chose to take the social media company to court on its own. [...] During the trial, jurors assessed whether Facebook misled users about privacy and content moderation 34 separate times. State prosecutors, though, argued Facebook's statements deceived the entire population of New Mexico and extended beyond social media users. In the end, jurors agreed with this premise and found Facebook liable for 2.1 million violations on certain counts, bringing the total number of violations to over 43 million. Facebook's attorneys have argued in subsequent court filings that the state's consumer protection laws don't apply to people in New Mexico who weren't using the platform at the time. [...] In one of the few wins for the defense, jurors found the state didn't prove that Facebook made false claims about removing harmful content, including misinformation about the COVID-19 pandemic. The state said the company favored certain accounts and allowed for violent or inaccurate content to proliferate. Attorney Randi McGinn said in her closing argument for the state that Facebook profited off harmful content, which CEO Mark Zuckerberg denied during his video deposition. Zuckerberg said the company has to carefully balance freedom of speech with content moderation. Attorneys for Facebook said the company has adapted its policies since the state's lawsuit was filed in 2021 and that it removes 99% of content that violates standards.

Read more of this story at Slashdot.

"According to a recent report by Bloomberg's Jason Schreier (paywalled), EA has reportedly decided to shut down BioWare," the studio behind the Dragon Age and Mass Effect games, writes longtime Slashdot reader atari_kid. Quartz reports: Chief Studios Officer Cam Weber and Chief Operating Officer David Tinson wrote that "over the past several months, we've taken a hard look at our business." They said a small BioWare team had been doing early groundwork on a Mass Effect game, but EA chose to drop the effort. That decision means closing the studio and its Edmonton workspace, they wrote. "We do not take this decision lightly," Weber and Tinson said of the BioWare closure, according to Variety. EA will keep investing in Apex Legends and is continuing work on two upcoming launches, Marvel's Iron Man and the next Star Wars Jedi game, the executives said. They added that EA's Respawn and DICE studios will join forces on an upcoming project, in addition to new Battlefield titles. Bloomberg said the project is probably a new installment of the Star Wars: Battlefront franchise.

Read more of this story at Slashdot.

OpenAI is bringing its models to Google Cloud's model garden and Antigravity coding tool, putting its technology on all three major U.S. cloud platforms after Microsoft's exclusive license ended earlier this year. "Google Cloud's longstanding investment in machine learning and AI has made it a destination for AI workloads and the developers and data scientists building them," OpenAI said in a blog post. It continues: [...] The integration will pair OpenAI's frontier models with Google Cloud's built-in access controls, centralized data governance, and high-performance infrastructure to support demanding enterprise workloads. Google Cloud customers will be able to purchase OpenAI frontier models via model garden, transacted through the Google Cloud Marketplace. Enterprises with Google Cloud spend commitments will be able to draw down their GCP commitments for these purchases. Additionally, OpenAI models will soon be available in Google Antigravity and the Gemini Agent, providing enterprise customers with model choice flexibility and the best model for each task. [...] For context, Microsoft previously held exclusive licensing rights to OpenAI's intellectual property, but that arrangement ended less than six months ago as OpenAI began expanding its partnerships with other cloud providers. Just one day after Microsoft's exclusivity ended, Amazon announced plans to host OpenAI's models on its cloud platform in April.

Read more of this story at Slashdot.

"PHP disclosed two critical vulnerabilities in their programming language and urged web site operators to immediately apply the fix," writes longtime Slashdot reader smooth wombat. "As a result, government web sites in Europe and elsewhere temporarily went dark on Wednesday as operators worked to protect their systems." The Independent reports: Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X. Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable. Special thanks to Slashdot readers Alain Williams and mrspoonsi for sharing this critical PHP security release. For more details, read the official PHP announcement and guidance on what to do next.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10. "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory stated. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here. Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they "expect mass attacks to start within 15 minutes of the release." A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Read more of this story at Slashdot.