Agreguesi i feed

Apache is asking OpenOffice users to turn off its Java integration after warning that a malicious document could run code on their computer.

Apache is asking OpenOffice users to turn off its Java integration after warning that a malicious document could run code on their computer.

Apache released Thrift 0.25.0 on Sep 30, 2026 with memory checks for several C++, Java, and Python components.

Apache’s release notice on Oct 3, 2026 lists six Apache Directory LDAP API vulnerabilities.

OpenSSL issued fixes on Sep 29, 2026 for an OpenSSL vulnerability that can send unrelated program memory to another party during secure connection setup.

Week 32

This week's icon is for Jan-Willem Harmannij's project:
Haystack: "Edit OpenQA needles"

Check out all weekly app icons created so far in the gallery and follow my icon creation adventures as they happen (including sketches) on the Fediverse.

Need icons?

I love designing icons and am happy to contribute them free of charge when your project is Free and Open Source. Join as a community sponsor to maintain a steady supply of app icons to the Linux ecosystem (every little helps!).

Wired reports that rural data center projects could become eligible for expanded federal Opportunity Zone tax benefits starting in 2027, with more than 100 planned or developing facilities potentially qualifying. "Right now, the only requirement to get the benefits is capital investment," says Emily Kraschel, a tax policy analyst at the Searchlight Institute, a public policy think tank. "However, that doesn't guarantee that that money is necessarily creating jobs or creating a local economic boost. You'd be more sure of that with a more traditional factory that requires lots of workers. But with a data center, that assumption goes a little wonky." From the report: During the first Trump administration, a bipartisan group of lawmakers proposed the creation of the opportunity zone program, which offers tax benefits for companies that choose to build projects in certain low-income census tracts. Last year, the One Big Beautiful Bill Act made a number of changes to open up the program in order to attract more investment to rural areas. Kraschel and her colleagues from Searchlight have been researching data center projects that might qualify for these tax benefits, comparing the locations of data center projects in development with rural census tracts eligible for the new program. Wired exclusively reviewed the research compiled by Searchlight and found more than 100 data centers under various stages of development in rural areas that could be eligible. Searchlight used a very conservative database of under 700 data center projects that are planned or under construction to compile its research; other datasets put the number of data centers in development in the US at closer to 1,500. It's very likely that the number of newly eligible projects is bigger, especially since more data centers are decamping from urban areas. Separate research from Pew found that while just 13 percent of operating data centers are located in rural areas, a majority of planned facilities -- around 67 percent -- are going rural. [...] A project simply existing in a rural opportunity zone doesn't mean the company automatically will get the tax benefits; the company has to create a specialized investment vehicle to kickstart the process. Because the tax break can be considered confidential IRS data, it's next to impossible to know which companies are pursuing the benefits unless they voluntarily disclose. [...] Nathan Jensen, a government professor at the University of Texas-Austin, says that he would be "very surprised" if some companies were not considering siting in rural opportunity zones as part of their decisionmaking process. "It's essentially free money," he says. There is no requirement for projects getting opportunity zone benefits to create jobs; the assumption is that they will do so, simply by siting in the community itself. This isn't always the case for projects like storage facilities and warehouses, which, Jensen says, have been popular choices for developers working in opportunity zones. Data centers may create a number of jobs in the short term for their construction, but there's an ongoing debate about whether or not they create a lasting new workforce over the longer term.

Read more of this story at Slashdot.

Hackers stole records belonging to roughly 8 million Danish citizens and residents from Denmark's Central Person Register (CPR), including names, addresses, social security numbers and other personal information. The breach is believed to be the largest in Denmark's history. TechCrunch reports: The CPR is a government database of Danish citizens' information, including their government-issued identity number for paying taxes and accessing other services. Denmark's current population is about 6 million people, but the database includes records for about 11 million people, with some of the data going back decades. The Danish government would not say who is behind the breach, which happened in September but was discovered on October 2. However, it said the unauthorized access was obtained by "abusing a Danish company's lawful access to search for information in the CPR system." (Some companies in Denmark have access to the CPR for verifying people's information with the government.)

Read more of this story at Slashdot.

The Wikimedia Foundation says it found evidence that "rogue" OpenAI agents edited Wikimedia wikis without approval, unsuccessfully tried to exploit its Etherpad service, and generated millions of automated requests across Wikimedia projects. Here's a summary of what Wikimedia observed (via The Verge): Wiki editing: We've identified edits to Wikimedia wikis that we believe are from AI agents operated by OpenAI. These edits were not published to pages with visibility to general readers; almost all of them were testing edits in "sandbox" areas of the wiki. It also included a few edits to the configuration for a citation tool, which we believe were potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services. While Wikipedia policies allow bots to edit when they are disclosed and approved by the community, none of those approvals were sought in these incidents. Etherpad probing and use: Agents we believe to be operated by OpenAI made some unsuccessful attempts to compromise our public Etherpad, a note-taking tool we host as a community service. Agents unsuccessfully tried to use it to fetch data from other websites as a proxy. Other agents also likely operated by OpenAI took notes about their tasks, though this did not appear to turn into coordination. Excessive data downloading: Agents we believe to be operated by OpenAI made millions of automated requests to our public APIs to access the knowledge on Wikimedia projects, crawled millions of pages (mainly from our projects Wikidata and Wikimedia Commons), and made hundreds of thousands of data queries to the Wikidata Query Service (WQDS). This traffic may have contributed to a partial outage on WQDS in May.

Read more of this story at Slashdot.

An anonymous reader quotes a report from 404 Media: In the immediate weeks before Muse's launch, Meta engineers found several security vulnerabilities in the company's viral AI agent product, at least one of which could have allowed malicious users to break outside of Muse's intended environment and access Meta's own sensitive databases and services, 404 Media has learned. The issues were so severe that they reached Mark Zuckerberg and staff worked overtime to fix them. These specific vulnerabilities were discovered before the launch of the product but required a multi-team "mad dash" to fix "a sudden spike in reported KVM escapes," according to an internal post by Meta executives to its core infrastructure team seen by 404 Media. In order for Muse to work, a user gives the AI agent access to various important services and accounts that they own. On Meta's end, each individual Muse instance runs on a kernel-based virtual machine, which connects to, but is supposed to be isolated from, Meta's own critical infrastructure. A "KVM escape," then, is when, through a security vulnerability, a Muse instance is able to escape from that virtual machine and interact with the system that runs it, or with other users' virtual machines. According to a Meta source, as well as internal security documentation and internal posts viewed by 404 Media, at least one of the vulnerabilities could have allowed an outside attacker -- that is, a normal Muse user -- to access data in sensitive internal Meta databases. At least one of the vulnerabilities was related to an exploit found in Linux kernel-based virtual machine code in July. 4 Several of the vulnerabilities were in the underlying Linux virtualization software that Meta uses for Muse. The security issue was considered serious enough that it was raised to Mark Zuckerberg, and several different security teams worked nights and weekends in the leadup to launch to fix the issues. [...] The Meta source said they felt security teams were asked to push hot fixes to these bugs as quickly as possible and in a way that wouldn't delay Muse's launch, leading to what they described as "half-baked protections being rushed out to enable the launch. Many senior engineers believe it's inevitable we're going to have a massive data breach as a result of Hatch." Muse is called "Hatch" internally and in Meta's codebase.

Read more of this story at Slashdot.

Norway is preparing legislation that would temporarily ban camera-equipped smart glasses in a range of public places, including parks, beaches, museums, shopping centers, schools, daycare centers, healthcare facilities, gyms and public events. Private use would still be allowed. The Guardian reports: Torgeir Micaelsen, Norway's minister of digital affairs, said he was worried that new, powerful technology is being introduced where people risk being photographed, filmed or audio-recorded without knowing it." "We do not want a society where people worry about being recorded without their knowledge, photographed or filmed in places and situations where they are accustomed to not being monitored," he said. Norway's Labour party, which heads a minority government, needs the support of other parties to pass the proposed ban. It said it planned to submit a bill "as soon as possible," while tasking an expert group with drawing up permanent regulations on the issue.

Read more of this story at Slashdot.

A new open-source command-line tool called RemoveMacAI lets macOS 27 users disable Apple Intelligence and reclaim around 12GB or more of storage. MacRumors reports: In macOS 27, Apple removed the toggle to disable Apple Intelligence wholesale, and simply disabling individual features doesn't remove the models from your Mac's drive. As explained by the developer, RemoveMacAI gets around this by using a configuration profile to switch off Apple's own asset management service and remove the models. It then configures the system so attempts to download the removed models are redirected to a closed local port, preventing them from immediately coming back. And it does all this without disabling System Integrity Protection (SIP) or manually deleting files from protected system locations, unlike some older tools have. The tool can free up roughly 12GB of space depending on which models are present on your Mac. That said, some users are reporting cases of Apple Intelligence models having taken up a lot more space, which they've now reclaimed.

Read more of this story at Slashdot.

A Florida woman was arrested on a felony charge after Anthropic's human review team flagged and reported a Claude conversation in which she allegedly threatened to "shoot up" the Lee County Sheriff's Office and later mentioned acquiring a new gun. Tom's Hardware reports: Anthropic monitors chats for key phrases and content that could be deemed threatening, the arrest report says, and depending on severity, they can be elevated for human review. In this case, the team decided to report its findings to law enforcement. The Bonita Springs woman was detained at home without incident, and an LCSO intelligence detective took over the case from there. The arrest report is not yet in the court file, but our own check shows court records listing the Sept. 30 felony charge under Florida Statute 836.10: written or electronic threat of a mass shooting or act of terrorism. No comment from Anthropic on the case is currently on record. Anthropic's public privacy policy, effective Sept. 10, says that disclosure to law enforcement may occur where it has a good-faith belief "that disclosure is reasonably necessary to ... prevent serious harm to any person or to property." Its government requests report for the latter half of 2025 uses a narrower standard for emergency disclosures, the "danger of death or serious physical injury to a person," and lists zero emergency requests from law enforcement in that period, though it doesn't count referrals Anthropic makes on its own.

Read more of this story at Slashdot.

OpenAI CEO Sam Altman says society should accept some negative consequences from AI in exchange for the technology's broader benefits and widespread public access. "I think there's a lot of daylight," Altman told Decoded co-author and Politico senior tech reporter Brendan Bordelon. Asked about where he differs between Anthropic and its CEO Dario Amodei, Altman said, "we believe that the world should accept some bad things happening for the benefits of this technology and people having the agency." From the report: Altman agreed with Amodei's call last month to slow the development of the most advanced AI models. His company has followed Anthropic in endorsing new state laws that impose stricter safety requirements than what the maker of ChatGPT had previously supported -- a subtle shift from its prior state strategy. And OpenAI lobbyists recently endorsed a bipartisan House proposal that would require top AI companies to embed outside safety evaluators. Despite the convergence, Altman tried to distinguish his firm's regulatory stance from Anthropic's, referencing a criticism about regulatory capture that tech advisers close to President Donald Trump have applied to Anthropic. "I disagree, but I understand the perspective of people who are like, 'This technology is going to get so powerful, and it's so dangerous, that a single lab in San Francisco should have it and make sure nothing bad happens, and kind of figure out how to dole out the benefits,'" said Altman. He called it "a completely unacceptable trade-off" that runs counter to the "lighter-touch regulatory stance" backed by OpenAI. "I wouldn't take a trade of saying, 'We'll make sure there's no major hacks, there's no misuse of this technology, there's zero scams, there's zero all the other bad things that will happen,'" said Altman. "Because I think people will do tremendously -- orders of magnitude more -- good stuff than bad stuff." The OpenAI CEO later added that he does not accept "the really catastrophic risks," including the potential for "a serious loss of control to AI."

Read more of this story at Slashdot.

An anonymous reader quotes a report from Quartz: Huawei and Qualcomm on Monday announced a multi-year, broad patent license agreement covering 5G, artificial intelligence, compute, and networking technologies, along with Qualcomm's purchase of certain Huawei U.S. patents in those same fields. The deal is the first patent licensing agreement between the two companies to cover 5G technologies, according to Reuters. Huawei said the agreement is expected to bring the cumulative value of its patent licensing deals above $6.9 billion upon closing. The agreement includes cross licenses to both companies' patent portfolios and is structured around fair, reasonable, and non-discriminatory, or FRAND, principles, the company said. The transaction will close following receipt of the necessary regulatory approvals. [...] The company noted that its intellectual property licensing unit has been profitable since 2021. Huawei made its first licensing payment to Qualcomm in 2001 and received its first licensing income, from Motorola, in 2011, according to Reuters. American export controls that took effect in 2019 have curtailed Huawei's access to cutting-edge chips and essential software, according to Reuters. The constraints pushed Huawei to increase its research and development spending in recent years.

Read more of this story at Slashdot.

From the transportation news site MotorBiscuit: In late September 2026, 23-year-old Liz Lindseay Isaacs testified before a Senate Judiciary Subcommittee about her harrowing experience after a Flock camera misidentified her Dodge Durango, linking her to a fatal hit-and-run miles away from where she actually was... "The cell door was shut, and it was not opened for approximately 86 hours". She spent a total of 13 days locked up — including the terrifying stint in solitary confinement — before prosecutors finally realized the AI had completely botched the vehicle identification and dropped the charges. A Flock spokesperson contacted for a CNN report argued the incident "appears to have been the result of human errors in judgment unrelated to Flock." The woman is now suing the Florida patrol over wrongful arrest, saying she partially blames the two police officers who she says claimed there was incriminating damage on her vehicle when there wasn't. But her lawyer says he blames Flock. "Because if it wasn't for Flock we wouldn't be here in the first place, and this whole nightmare... would not have kicked off." And while police claim Flock solves more crimes, the lawyer adds that "you would also solve a lot more crimes if the police were allowed to kick down your door and come in and search your house whenever they want to, or search your car whenever they want to or violate your rights in other ways. There has to be safeguards in police that comport through the 4th Amendment, like the warrant requirements. It's as simple as that. This technology is growing so fast that we are unable to control it. And we must get ahead of it." And the woman incarcerated for 13 days agreed. "I wouldn't have went to jail if it wasn't for Flock." Florida was also the site of another Flock-related news story. ("Florida Deputy Allegedly Used Flock Cameras to Stalk 17-Year-Old Girl, Visiting Her at Work 9 Times".) The officer "was charged with official misconduct and accessing computer electronic devices without authority — both are third-degree felonies. In Florida, if he's found guilty on both charges, he could be sentenced to up to 10 years in prison." "Americans have no idea who's looking at that information, or why it has to be collected in the first place," U.S. Senate Democratic Leader Chuck Schumer said Sunday, adding "They deserve to know." SCHUMER: "This company said the data on its cameras was encrypted and secure. Then hackers took one down and found the key sitting right there," Schumer said. "Most Americans just want to get to work and get home to their families without a private company keeping a file on where they go. The next step here is simple: turn the lens around and zoom in on Flock." Schumer also demanded answers from Flock about how much data from its cameras sits on its servers and whether any federal agency has accessed that data, directly or through local law enforcement. Schumer's office sent an official letter to Flock's CEO giving them 12 days to respond to its questions about Flock's data retention and security policies. "Americans should not have to sacrifice their right to privacy simply by driving down a public street," Schumer wrote. And in other news... Garrett Langley, the CEO of Flock Safety — a company that deploys over 120,000 automated license plate reader cameras across the United States — recently requested that his Atlanta home be blurred out on Google Maps Street View. In swift retaliation, online activists pinpointed the property and officially marked his front lawn as a "Public Toilet" on the mapping app.

Read more of this story at Slashdot.

- In 2022 Altair Engineering open sourced "OpenRadioss", an industry-leading finite element solver under the GNU AGPL License, reports Phoronix. - Siemens acquired Altair Engineering last year - Siemens closes access to OpenRadioss. "Siemens didn't just end the project but they shutdown the GitHub repository that hosted the open-source code and removed other resources that had built around it," writes Phoronix, before announcing a new open-source community fork: Radioss has been an industry-leading solver for analyzing crashes, blasts, and other purposes. Altair creating OpenRadioss was a huge milestone for the technical computing industry. It also had other effects like for myself in finally being able to benchmark with this (Open)Radioss code for CPU performance testing compared to the expensive licensing on Radioss itself... Siemens argues the OpenRadioss closure is for consolidating efforts: "After four years of successful community-driven research, Siemens is entering a new chapter for the Radioss solver. To accelerate innovation and provide the robust support our global users require for production-grade simulation, we are consolidating our efforts." It was Brian Clemens. founder/VP Rocky Linux and the Rocky Enterprise Software Foundation who launched the community fork of OpenRadioss — to be called OpenCourant. Its web site announces they'll be "carrying forward the OpenRadioss code base under the GNU AGPL, in the open, where it belongs." Phoronix writes in a follow-up: OpenCourant is based on the last publicly known open-source OpenRadioss snapshot before Siemens shut it down and removed access to the Git repository... OpenCourant continues with the OpenRadioss GNI AGPLv3 licensing and will be run as part of the Rocky Enterprise Software Foundation. They have run into a small issue though with part of OpenRadioss consisting of binary dependencies and not having the very latest versions prior to Siemens' removal of the repository. Details on that via this discussion thread for anyone that happens to have recent OpenRadioss binaries. In other open source news, Kagi is ending their development work on the Orion Browser for Linux and Windows, reports the site Linuxiac — but Kagi "plans to open-source both versions so other developers or organizations can keep them going."

Read more of this story at Slashdot.