Slashdot

For the first time, the UN has declared that exceeding the Paris Agreement's 1.5C warming limit is "imminent and unavoidable." "We are now saying this window has closed, but we can open it again by making the overshoot as brief as possible," UN Environment Program Executive Director Inger Andersen said on a call with reporters. "This is about how to find a way back as shortly and as quickly as possible with as limited an overshoot as possible." CNN reports: Past reports have examined the distance between countries' emissions reduction commitments and what it would take to limit global warming to 1.5 C above preindustrial levels. However, this year's report redefines the gap. Instead, it examines new emissions overshoot scenarios, and what it would take to limit peak warming to just 1.7 to 1.8 degrees C before bringing temperatures back down to 1.5 C through emissions cuts and the use of carbon removal technologies. The report makes clear that every additional fraction of a degree of warming above 1.5 C "raises the risk of irreversible changes including in ice sheets, permafrost carbon, ocean circulation, and coral systems, along with devastating human impacts." Each added fraction of a degree of warming can have an "immense" impact "as measured in terms of damage, cost and loss of lives," said climate scientist Michael Mann of the University of Pennsylvania. Mann was not involved in producing the UNEP report. According to the UNEP, which is based in Nairobi, the lowest overshoot scenario would keep peak warming to between 1.7 and 1.8 degrees C and return global average temperatures to at or below 1.5 C by 2100. However, to follow such a pathway, global greenhouse gas emissions would need to be slashed by far more than anything currently on the table at the upcoming COP31 talks. This would require an 18% cut by 2030, 45% by 2035, and 69% by 2040, relative to 2025 levels. Meeting this lowest-possible overshoot scenario would require a tripling of renewable electricity capacity by 2035, and dramatic cuts to fossil fuels, including the phaseout of coal by 2040, the report states. In addition, there would need to be a major scaling up of carbon removal technologies, which so far have not been proven to work at such a large scale. In stark contrast to these figures, the fulfillment of existing emissions reduction pledges would only yield a 5-to-8% emissions cut by 2030 and an 11-to-15% reduction by 2035, the report found. This would be associated with a peak warming of about 2.6 degrees C. If countries simply follow their current policies, then warming could reach a peak of about 2.8 C. That estimate has increased since last year, in part because of the withdrawal of the United States from the Paris Agreement and retraction of its emissions reduction commitments, the report states. Even the scenario that assumes countries meet their existing reduction commitments, and nations with net-zero pledges succeed in fulfilling them, still brings warming to a peak of 2.1 C.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Axios: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service. [...] This presents significant security risks: banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds. In other instances, some banks have tracked activity when agents -- programmed to fulfill requests or complete tasks on a user's behalf -- contact call centers or appear to take actions independent of user instructions, the people said. Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The concerns are at the root of the decision by several banks to restrict third-party AI agent access, the people said. Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents. [...] Many banks are broadly not able to parse whether agent account activity is user-directed, sources said. [...] On one hand, banks are best positioned to respond to the threats and opportunities of AI given their cash on hand and experience as critical infrastructure. But money isn't necessarily enough to solve this problem, one source said, because of how quickly the technology is developing and revealing new weaknesses in real time. Banks are investing in preventing worst-case scenarios, but they are also preparing for when those could happen, including with "day after" scenario planning that would allow them to quickly secure or restore customer access, sources said.

Read more of this story at Slashdot.

Google is funding one of the nation's largest "virtual power plants," paying homes and businesses indirectly to reduce electricity consumption during periods of peak demand so more grid capacity can be available for data centers. Under its expanded deal with Voltus, the program could provide up to 1,070 megawatts in the Mid-Atlantic PJM grid -- roughly the output of a large nuclear reactor. The New York Times reports: That electricity won't come from new power plants. Instead, Voltus will sign up homes and businesses and give them financial incentives to curb their usage when local power demand is high or the grid is strained. Many of these reductions could occur automatically, such as through smart thermostats that dial back air-conditioning during peak summer hours or batteries that can provide temporary on-site power. Each of these tweaks frees up only a small amount of power on its own. But by aggregating them across thousands of businesses and homes, Voltus says it can reliably provide lots of extra capacity when it's most needed, and do so within a few years. While tech companies will likely ultimately need to build traditional power plants if they want to keep building large data centers, this approach could be a faster, cheaper and less-polluting option in the interim. "We really see virtual power plants as a critical short-term solution," said Ellen Zuckerman, head of energy market development for North and South America at Google. "It's a way to invest in our communities, really double down on our clean energy ambition, but also meet capacity at speed and scale."

Read more of this story at Slashdot.

joshuark shares a report from BleepingComputer: Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet. Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP). "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," it said. "In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'" After releasing the October 2026 Patch Tuesday Windows 11 cumulative updates, Microsoft marked the bug as resolved, but in a Tuesday update it said the issues weren't actually addressed and that a fix would ship later. "This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated," it said in a service alert sent to IT admins. "A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion." While Microsoft continues working on a permanent solution, it shared a temporary fix that requires affected customers to choose one of two VPN tunneling protocols to work around the issue.

Read more of this story at Slashdot.

The Browser Company is shutting down its Arc browser on December 22 and encouraging users to migrate to Dia, its newer AI-powered browser for Apple Silicon Macs and Windows 11 PCs. Thurrott reports: In the message explaining why it was sunsetting Arc, The Browser Company explained that maintaining two separate browsers was difficult to justify, especially from a security perspective. "Dia was built from the ground up to meet today's security standards, so that's where our engineering and security teams will focus moving forward," the company wrote. The retirement of Arc will be gradual: While nothing changes for existing Arc users, it's no longer possible to create new Arc accounts as of today. On November 23, tab sync, Browse for Me, and other AI features will be disabled on the iOS and Android versions of Arc. Lastly, the desktop version of Arc will stop working on December 22, and Arc accounts will be deactivated.

Read more of this story at Slashdot.

Moderna shares plunged as much as 25% after partial clinical trial data leaked for its personalized cancer vaccine developed with Merck, despite the full results showing promising outcomes for melanoma patients. Analysts attribute the selloff largely to inflated investor expectations rather than disappointing clinical results. CNBC reports: The personalized vaccine, known as intismeran autogene, paired with Merck's immunotherapy Keytruda reduced the risk of recurrence or death in certain melanoma patients by 42% compared with Keytruda alone. The data also showed the shot along with Keytruda reduced the risk of cancer spreading to distant parts of the body or death by 38%, compared with just the immunotherapy. The companies say about 82% of patients who received the personalized cancer vaccine alongside Keytruda were alive without their melanoma returning at two years, compared with 70% of those who received Keytruda alone. [...] Investors see the targeted vaccine as a possible breakthrough treatment, with the potential to be used in other forms of cancer in the future. It could also offer Moderna a critical additional commercial product in its pipeline, following vaccines for Covid-19, the flu and respiratory syncytial virus. "We assert this relative reduction in recurrence/death is clinically meaningful," said BMO Capital Markets analyst Evan Seigerman. "Such a reaction likely reflects inflated expectations into the full data release, rather than a true indictment on the efficacy of the combo therapy." UBS analysts said "this is overall a strong data set" and gives more confidence in upcoming studies of the vaccine in kidney and bladder cancers. They added the stock reaction may be due more to massive expectations than disappointing data.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Wired: Longtime audio giant Bose announced on Wednesday that it's acquiring Skullcandy, the lifestyle brand known for its bass-heavy headphones. Skullcandy will remain a separate company within Bose's Premium Consumer Audio business and will still be based in Park City, Utah. The acquisition isn't out of left field. Bose has lent its audio expertise to Skullcandy over the past year under its Sound by Bose licensing program. Skullcandy designs the headphones and then works with Bose on the audio front. The relationship began with the Skullcandy Method 360 ANC earbuds in 2025 and more recently, with the Crusher 1080 ANC headphones in July. [...] This is hardly Bose's first audio acquisition (though it may be the most mainstream). Bose acquired McIntosh Group, owners of luxury audio brands McIntosh Laboratory and Sonus Faber, back in 2024. But Bose seems to be after Skullcandy's connection to its community. "What does the brand stand for? Does it have meaning for consumers? Is it relevant to a group of consumers that, frankly, we otherwise aren't reaching?" Bose CEO Lila Snyder tells WIRED. "If you think about McIntosh, Sonus Faber, and Skullcandy, they all fit into that realm. Skullcandy gives us access to a customer base that we think we're largely missing with the Bose brand." That's why Bose has no plans to relocate Skullcandy from Park City, Utah, which Snyder says is the epicenter of board sports culture. "We want to make sure we're right at the heart of it, as they always have been," she says. Skullcandy products are also affordable, especially compared to other Bose products and Bose-owned brands, which lets Bose compete at both ends of the market.

Read more of this story at Slashdot.

BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, "The PHP story feels like the cyber equivalent of an unexploded bomb -- I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet." Although no successful attacks have been confirmed, the AI-assisted discovery of long-hidden flaws has triggered a worldwide security scramble, with websites taken offline as a precaution and administrators racing to deploy patches before attackers can exploit the vulnerabilities. From the report: The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. [...] It was supposed to be kept quiet until everyone had a chance to fix their sites -- but the news was leaked. From that point the clock started ticking. As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. "There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out." But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success. "We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," Gina Neff, Professor of Responsible AI at Queen Mary University, told the Today Program on BBC Radio 4. "We have enormous capability to handle these risks."

Read more of this story at Slashdot.