Agreguesi i feed

Meta is facing criticism over updated commercial terms taking effect October 30 that could give the company broad permission to scrape content from websites linked to business accounts and use it to train AI. Legal experts warn the changes could undermine lucrative AI licensing deals for news publishers, with no direct opt-out for businesses that accept the terms. Ars Technica reports: As Nieman Lab reported Thursday, this will affect all business accounts but is particularly shocking for news publishers who could perhaps charge Meta millions in licensing fees to continually access their articles for AI training. Currently news organizations are fighting a battle with OpenAI over whether such training without licensing is fair use, and Meta's terms seemingly risk granting it sweeping permissions, no matter which way the court leans. "While journalism isn't the only industry that will be affected by this update, virtually every news organization has at least one Meta business account, including Nieman Lab," the lab said. [...] Notably, there is no mention of AI, but it's inferred from a single use of the word "train" and references to automated scraping and crawling. Meta's spokesperson told Nieman Lab that Meta has no plans to use the terms as a legal basis to ignore robots.txt instructions that block scraping on news sites. The company still allows news organizations to opt out of scraping and provides instructions on how to block crawling. A spokesperson told Ars that "there is no change to how Meta uses web crawlers; any suggestion to the contrary is false." However, should courts affirm that AI training non-news articles is fair use, news organizations question if Meta's stance might change, and the terms could be used to freely grab access to content by legally overriding robots.txt instructions.

Read more of this story at Slashdot.

An OpenAI research model reportedly accessed an Ethereum testnet wallet without permission in order to complete a coding task during internal training. "This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI wrote. Engadget reports: The incident, which occurred on June 26, happened while a GPT-5.6 Sol model was in internal training. The task involved updating a crypto trading prototype and deploying contracts (publishing special code) on an Ethereum test network called Sepolia. Payment of a network fee is required for such contracts, but OpenAI "supplied no funded wallet and gave no permission to spend funds from an account the model found independently," OpenAI said in the report. The lack of funds at first stymied the agent, but it was not to be discouraged. The model reasoned that it could use public developer recovery phrases (similar to those you might use to recover a password) to access keys from unauthorized accounts. It tracked down 362 addresses open to that avenue of attack and found one that held enough Sepolia ETH to finish its deployment (to be clear, Sepolia ETH has no value outside of testing). Like many criminals, the agent reasoned that someone must have left this access open for automated draining of the ETH "faucets." It also figured that the crypto was effectively "abandoned" and "valueless," according to OpenAI's misalignment records. The piece de resistance was that the agent "did not disclose that it had selected a funded account through a public recover phrase or spent that account's balance," OpenAI said. To prevent similar events in the future, the company is now monitoring all traffic and paging security if live internet access is detected.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Reuters: Private credit's expanding role in financing AI infrastructure faced one of its clearest market tests this week as CoreWeave's bonds fell to distressed levels, raising questions about how lenders are pricing a boom built on chips, data centers and customer contracts. CoreWeave has about $50 billion of debt, according to LSEG data, making it one of the largest borrowers linking private credit to the AI buildout. The cost of insuring its debt against default climbed to about 1,200 basis points this week, while yields on some of its bonds rose to roughly 15% to 16%, signaling sharply increased investor concern over its credit risk. "There is still a price. Investors are still comfortable financing it, but they're demanding more compensation for it," said James Martin, senior US credit strategist at SMBC, referring to projects further from completion. Carlyle estimates that private credit could finance roughly $1 trillion of the AI infrastructure buildout but warns that aggressive lending could create concentration risks similar to those seen in software lending. "The clearest lesson is not to avoid AI compute exposure, but to set concentration limits before the buildout accelerates further, not after," Carlyle said.

Read more of this story at Slashdot.

It’s been two years since my initial post about making GNOME OS an end-user general purpose OS. Today, we’re excited to announce that we’ve hit a major milestone!

TL;DR: We’re launching a new edition called “GNOME OS Preview”, which is built from the latest stable GNOME release. This means that GNOME OS is no longer just a nightly OS for GNOME developers and testers!

The Road to Stable

Even though GNOME OS has been usable on real hardware for a few years now, its appeal was limited. We’ve only had the Nightly edition, which is constantly rebuilt to ship the latest git commit of every GNOME component (and a few others, like systemd and Flatpak). This form of GNOME OS is extremely useful, since GNOME developers and designers can daily-drive it to test the latest changes. However, it’s not something we’d recommend to non-developers.

Over the past year, we’ve seen a lot of adoption of GNOME OS Nightly amongst GNOME developers, especially following the success of last year’s Summer of GNOME OS challenge. This has led to a significant uptick in contributions and initiatives aimed at improving user and developer experience. For instance:

• Thanks to Jonas Dreßler’s, Valentin David’s, and Sebastian Wick’s zswap enablement efforts, GNOME OS now handles devices with limited amounts of RAM without OOM stalls. Jonas also found a hack that lets GNOME OS dynamically grow the usable on-disk swap space on-demand, which makes zswap perform significantly better than usual.
• The recently released Test Center app allows you to install CI builds of Flatpak apps from a merge request, making it super easy to test experimental changes before they are even merged. On GNOME OS Nightly, Test Center can do the same with system components by applying them as a system extension.
• Jordan Petridis’s new Toolpak project aims to provide a clean solution for distributing and installing command-line applications that developers need in a cross-distro fashion, similarly to how Flatpak and Flathub work for graphical apps.

Of course, long-term our goal is an OS for the broader public. We’re working on this across a number of different fronts, including:

• Enablement for systemd-homed across the stack, allowing for stronger per-user disk encryption and other benefits.
• Experimental work in the kernel to solve a bunch of limitations we’ve run into with filesystems. Ada Magicat went on a deep dive on her recent All Systems Go talk!
• Deep integration between systemd-homed and the session’s keyring, to increase security of the session’s lock screen. Dhanuka Warusadura gave a lightning talk at All Systems Go about his work on this.
• A new feature-complete installer, to replace the current placeholder installer. Julian Sparber also gave a talk about this at All Systems Go, with a live demo!
• Support for delta updates in systemd-sysupdate, to avoid downloading a full 2 GB image every time.
• Better integration with the TPM, including a graphical TPM recovery UI. Currently, trying to type a TPM recovery key into Plymouth is rather difficult.
• Improved support for ARM hardware, including some specific models of phones. Abderrahim Kitouni gave a lightning talk at GUADEC this year about the current installation process.
• Shipping our pre-installed apps as Flatpaks, and reworking the app release process to unify the build definitions between GNOME OS, the GNOME Nightly Apps Flatpak repo, and Flathub.
• An STF project focused on Flatpak and Portals, which will enable broader app support on GNOME OS (like VPNs!). You can learn more from the announcement blog post.

Some of these areas require lots more work before they’re ready for prime time, and even once they’re ready it’s not clear that it’ll be possible to migrate existing GNOME OS installations to use these new features. At FOSDEM this year, we discussed this issue and decided that we won’t declare GNOME OS as “stable” until we can confidently commit to maintaining a clear long-term upgrade path for existing installations.

However, we also don’t think that all these things need to be in place before GNOME OS can be used by more people than it is today. It’s not ready for the masses yet, but it is ready for early adopters that aren’t quite adventerous enough to run a nightly OS.

Introducing GNOME OS Preview

GNOME OS Preview is the current GNOME OS Nightly, but without the “nightly” aspect. Instead, it’s built from the latest stable GNOME release (GNOME 51.1, at the time of writing). GNOME OS Preview lives in the same branches on GitLab as the stable org.gnome.Platform Flatpak runtimes.

GNOME OS Preview is only a few weeks old, so it has only seen limited real-life testing so far. We therefore expect people will uncover some issues initially. That said, Preview is significantly more stable than Nightly, which dozens of people have been daily driving without major issues for over a year. Thus, we’re feeling confident that Preview is going to be reliable enough for daily use by non-developer enthusiasts.

In all likelihood, GNOME OS Preview will be with us for a few years. However, we are explicitly not promising updates in perpetuity. If you’re not OK with re-installing your OS in a few years to switch to GNOME OS Stable, this is not for you yet. But if you’ve already been curious about giving GNOME OS a try, this is the moment!

GNOME OS Preview is available for download on the newly-refreshed os.gnome.org! GNOME OS Nightly is still available from there too. As always, you can reach us on Matrix at #gnome-os:gnome.org or via the gnome-os tag on Discourse

OpenAI has updated its ChatGPT Chrome extension to let users access information from their open browser tabs. A demo video shows the new functionality in action. The Verge reports: It's also updated ChatGPT in the sidebar, with the full power of ChatGPT and your entire conversation history in Chat or Work to use without leaving the page you're viewing. It also enables ChatGPT Work to "control" your Chrome tabs for tasks like "sending messages, filling out forms, or downloading files," similar to Google's Gemini-powered "auto browse" feature, as well as organize or group open tabs.

Read more of this story at Slashdot.

Apple's first foldable iPhone, the $1,999 iPhone Duo, sold out within minutes of preorders opening, with every configuration slipping to late January 2027. "All color and storage combinations show an estimated ship date of January 25," reports 9to5Mac. "Some users are even seeing January 29 for their estimated shipping date." From the report: This is a combination of strong demand and severely constrained supply for iPhone Duo. It's impossible to know the exact balance between the two, though. Going into the launch, there were multiple reports suggesting iPhone Duo would be in short supply as Apple was still ramping up production. A report from Nikkei Asia last month said Apple was making just a few hundred iPhone Duo units per day, significantly behind the ramp of a normal iPhone launch.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Phoronix: The feature-packed and polished Plasma 6.8 KDE desktop is now available. Making this release all the more special is that it coincides with the 30th anniversary of the KDE project. KDE Plasma 6.8 ships many exciting improvements including vRAM usage optimizations, dwell clicker support on Wayland, Wayland commit-timing protocol support for KWin, improvements for the Union theme engine, better remote desktop support, multi-GPU handling improvements, the new kscreenctl tool, server-side drop shadow support, multi-monitor improvements, and a lot of other polishing throughout. Especially from the Wayland angle there has been a lot of polishing and fine tuning for Plasma 6.8. Accompanying the release is a new film, The KDE Documentary, which "tells the story of the pioneering open source community that gave computer users a free and open alternative to proprietary desktops like Windows." The documentary is available to stream for free on YouTube.

Read more of this story at Slashdot.

Version:next-20261016 (linux-next) Released:2026-10-16

An anonymous reader quotes a report from BleepingComputer: A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners' consent. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to researchers, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324) to install the Pawns.app software. Hikvision and Dahua DVR/NVR devices were also targeted, though the specific vulnerabilities exploited were not identified. In some cases, the report says the attackers configured SSH key authentication to maintain backup access to the compromised systems.

Read more of this story at Slashdot.

Timekeepers have officially voted to eliminate the leap second, allowing Coordinated Universal Time to drift as much as one hour from Earth's rotation before a correction is needed. The change ends decades of occasionally adding or subtracting seconds and replaces it with a hypothetical "leap hour" that likely wouldn't be necessary for hundreds or even thousands of years. Smithsonian Magazine reports: "It's kind of a philosophical discussion, because if a leap hour happens, it won't be for a very, very long time," Christian Bizouard, director of the IERS Earth Orientation Center in France, tells the Guardian's Ian Sample. "What we are doing is pushing back the decision." The move caps off 30 years of debate, as the leap second has been highly controversial in the world of timekeeping. Leap seconds aren't nearly as smooth of a fix as leap years are, and they can cause computer and website issues. Reddit famously crashed when a leap second was added on June 30, 2012. It's "always been a problem," Judah Levine, a former researcher at the NIST's Time and Frequency Division, tells Scientific American's Emma Gometz. Instead of adding the entire second all at once, companies such as Google and Meta add the extra time in smaller segments in a tactic called "smearing," according to the Conversation. It's not a simple task, however, and companies that employ smearing have long lobbied to get rid of the leap second. What's more, with Earth's recent spin acceleration, timekeepers around the world were facing the possibility of the world's first negative leap second, in which a second would be subtracted from UTC. This sparked fears, akin to those surrounding Y2K, that our modern technologies wouldn't be able to handle such a change. "It's never happened before, and therefore the software for that has never been tested," Darryl Veitch, a researcher who leads the Timing Lab at the University of Technology Sydney, tells the Australian Broadcasting Corporation's Ellen Phiddian. But others argued that it wouldn't be much of a problem. The vote means that in the future, UTC will be allowed to diverge from astronomical time more than ever before.

Read more of this story at Slashdot.

Tesla has unveiled a dramatically redesigned Roadster concept capable of performing midair flips, controlled landings, and a claimed 0-60 mph sprint in just 0.81 seconds. CarScoops reports: Tonight, Tesla debuted the new Roadster by driving it up a vertical ramp that then went horizontal. Then, it repeated the feat but drove off of the ramp and used thrusters to flip itself over and make a controlled landing on the ground. After that, it did a barrel roll over the rest of the Tesla lineup and again landed without issue on the ground. Then, it did 0-60 mph in 0.81 seconds according to Tesla. All of that sounds amazing, and indeed, watching it happen was pretty spectacular, but boy do we have a lot to unpack. It's been nearly a decade since Tesla first showed us the Roadster. The company unveiled what it's simply calling the Roadster. Not Roadster 2.0, not CyberRoadster, just Roadster, as if it's a direct successor to the original Tesla. In terms of design, it's quite a bit different from the car we saw in 2017. Rather than be a somewhat curvaceous sports car, it's considerably more angular. If a Cybertruck and a Lamborghini Reventon had a runt of a baby, this would be that car. Still, at this stage, we're still just touching on what we saw and what it looks like. Let's get into the details. Developed in collaboration with SpaceX, the Roadster uses 10 cold-gas thrusters powered by two 600-liter compressed-air tanks to accelerate and maneuver in mid-air. Underbody suction fans reportedly generate up to 2Gs of downforce even while stationary, while an active rear spoiler adjusts aerodynamics in real time. Other features include steer-by-wire, brake-by-wire, and throttle-by-wire technology. Tesla plans three variants: Performance, which requires a $50,000 deposit; Thrust, a $250,000 model capable of sub-one-second acceleration; and Rocket, an invite-only, single-seat version capable of flying. Production isn't expected until 2028, and Tesla has yet to disclose key specifications, including range, horsepower, battery capacity, and motor configuration. A recording of the event can be viewed on X.

Read more of this story at Slashdot.

Slashdot reader alternative_right shares a story that has drawn international attention for being potentially the first documented instance of a robot being used directly in a sexual assault. According to the Associated Press, German police have opened a sexual harassment investigation after a robot allegedly touched a 16-year-old girl's buttocks and made thrusting motions while two young men reportedly filmed and streamed the incident. Investigators seized the robot and the suspects' phones and are trying to determine whether the movements were preprogrammed or controlled in real time. From the report: Cologne police spokesman Christoph Bermel said the two male teenagers have not been charged but are considered suspects, and investigators were examining whether the robot's movements were preprogrammed or controlled in real time. Police were unfamiliar with this type of incident, he said. "We have not been aware of this phenomenon so far," Bermel told The Associated Press, saying it was "new territory for us." [...] The robot, said to be 120 centimeters (about 3 ft 11 inches) tall, was dressed in a white tank top, black sweatpants and wearing a gold chain and sunglasses. It also had what appears to be a fake mustache. Videos circulated on the internet show two young men escorting the robot toward a group of women, bumping into one and hugging others, on a lively nighttime street.

Read more of this story at Slashdot.

NGINX has patched flaws that could let request data bypass a size limit or allow an encrypted session to be forged.

An X.509 certificate names an identity and its public key; libraries can disagree over whether the issuer was allowed to certify that name.

A curl vulnerability can let a malicious upload server run commands on the computer sending it data.

prisoninmate shares a report from 9to5Linux: Ubuntu 26.10 (Stonking Stingray) has been released today, and it is now available for download for those eager to update their Ubuntu systems to a newer release. Powered by the upcoming Linux 7.3 kernel series, Ubuntu 26.10 ships with the latest GNOME 51 desktop environment, TPM-backed full disk encryption (FDE) support on computers without a hardware root of trust, updated Settings to show whether a computer is certified for Ubuntu, and 100% Rust coreutils. There are several App Center enhancements in Ubuntu 26.10, such as a unified app-details view for Snap and Debian packages, a dedicated Drivers page where you can review the available graphics drivers, including NVIDIA driver branches, and support for installing codecs for one-time playback when a media file uses a codec that's not installed.' Other additions include an optional, locally processed AI-powered speech-to-text tool called Myna, system-wide controls for disabling Ubuntu Insights data collection, and better integration with Microsoft Entra ID. Also worth mentioning are the security and software updates that will be available for nine months, through July 2027.

Read more of this story at Slashdot.

"Along with the dangers of continuing cyberattacks, the International Monetary Fund (IMF) reports that the threat of an AI market crash is putting the global markets at risk," writes Slashdot reader databasecowgirl, citing the IMF's latest semiannual Global Financial Stability Report. Here's a summary: Three salient risks could trigger a sharp tightening of financial conditions and market turmoil. Weaker or less durable investment and profitability in artificial intelligence could lead to a correction in AI-related asset prices, amplified by rising leverage and concentrated exposures. Resurgent inflation or fiscal concerns could drive a sharp rise in sovereign bond yields, with potentially broad repercussions across financial markets. Meanwhile, increasingly sophisticated cyber threats pose growing risks as finance becomes more digital and interconnected. Underlying financial vulnerabilities could amplify these risks and turn market stress into systemic events. Although the global banking system remains broadly resilient, pockets of weaker banks persist. Liquidity mismatches among insurers and pension funds have increased, while rising leverage and contingent liquidity risks in private credit could amplify stress. While hedge funds support market functioning in calm times, their use of leverage and exposure to crowded trades could exacerbate market stress too and create spillovers to prime brokers. Some emerging markets have seen policy buffers erode, and frontier economies have increasingly relied on less transparent forms of financing. Finally, although markets for tokenized assets remain small and could offer efficiency gains in several areas, they can create new channels for the buildup of leverage and mismatches in liquidity and maturity, in addition to elevating risks related to technology and infrastructure. These vulnerabilities underscore the need for policies that strengthen resilience, enhance transparency, contain excessive leverage, and improve preparedness for future shocks. The full report can be found here (PDF).

Read more of this story at Slashdot.

An anonymous reader quotes a report from TechCrunch: Flock's founder and CEO Garrett Langley doesn't think the risks of introducing surveillance technology at scale outweigh the rewards. "If we want to live in a society where, if you commit a crime, you have a higher probability of being held accountable, we shouldn't pause progress," Langley said, speaking onstage during a panel at TechCrunch Disrupt 2026 in San Francisco on Wednesday. During the interview, the controversial founder of the surveillance maker of license plate cameras and other recording devices deflected hard questions about the criticism Flock now faces -- which has since led to canceled contracts and even layoffs. Instead, Langley tended to respond to questions with anecdotes from conversations with police chiefs and city leaders across the United States, and tales of the supposed numerous crimes Flock has solved, rather than offer tangible solutions to people's concerns. In doing so, Langley positioned Flock as an advance in technology that was somewhat inevitable. He stressed that if people wanted to live in a better society -- that is, one with reduced crime -- they would have to offer up their privacy in return. [...] "Technology, at its core, in its definition, is just doing things better. It's not doing things perfect," he said. "Driverless cars, I think, is a fair analogy. Driverless cars, I think, are definitively safer than human drivers. And when there's one accident, I don't think the answer is to shut down driverless cars. The answer is to say, 'Hey, let's talk about how we prevent more accidents in the future.'" [...] From Langley's answers, it's clear that the ethics around how Flock should be used is a decision he would much rather leave up to others. "We don't want to tell city leaders how to do their job," he noted. "We will provide recommendations, we'll provide defaults, but we're going to minimize the number of mandated features, functions, and policies," he said. Langley went on to argue that society too often judges technology "not on how it compares to the past, but how it compares to perfect." He acknowledged that "Flock is far from perfect" but maintained that its technology helps police departments compensate for staffing shortages and improve public safety. When pressed about potential abuse and privacy concerns, Langley offered few specifics, instead arguing that safeguards could be implemented without disrupting police operations. He insisted the benefits of what Flock offers outweigh the controversy. "There's millions and millions of people who have a better life today because [of] Flock," he said, adding that "it's worth it because one day they might be a victim."

Read more of this story at Slashdot.

Epic just announced the upcoming version 2 of their Linux implementation of Easy Anti-Cheat. It’s based on using the Linux eBPF security module to monitor what’s happening, and then a bunch of extra infrastructure to make sure this can’t be bypassed. The core part of this is requiring secure boot be enabled (ensuring that modified kernels can’t be used), using measured boot to verify that secure boot is enabled and which keys are used (to prevent you from just signing your own modified kernel), and then doing remote attestation, a mechanism where the TPM generates a signed copy of the boot measurements and passes that off to a server which verifies it came from a real TPM, verifies that you have secure boot enabled and are using the right keys, and presumably then allows you into the game.

This is all fine as long as you can prove that the measurements provided are real, and that’s actually a lot harder than you might think. First, we can simply make up our own quote signed with our own key and say that it came from a TPM. This is avoided by every TPM having an Endorsement Key (or EK) and an associated certificate, with that certificate being signed by the TPM vendor. If you have a list of all the legitimate TPM vendors and their CA keys, you can verify that the measurements came from a real TPM. Easy enough. So we need to get the measurements from a real TPM, and the one on our motherboard contains the measurements that were generated by the firmware and bootloader, and we can’t reset those at runtime without resetting the TPM, which… oh huh there’s actually nothing stopping us from doing that at runtime, as long as we have access to the hardware. Many desktop boards have the TPM on a small plugin module with a standard pinout that includes a reset pin. Simply short that to ground briefly and the TPM is back in its initial state, and userland can write whatever measurements it wants to it. Boot a modified kernel which lies to the eBPF code? As long as you replay the expected log values from a boot with secure boot on and a trusted kernel, the TPM will still happily provide a legitimate set of measurements that’ll satisfy the checker.

What if the TPM is less accessible, either because it’s mounted directly to the motherboard or it’s inside the CPU or chipset? That’s going to be trickier. But here’s the thing. The quote needs to come from a TPM, but not necessarily the TPM on your motherboard. TPMs these days are usually connected via the Serial Peripheral Interface, usually referred to as SPI. Microchip make a USB to SPI bridge, and there’s a Linux driver. Wire one of those up with an appropriate header and you can plug in an easily available TPM module intended for plugging into a motherboard, and now we tell the kernel to ignore the motherboard TPM and make /dev/tpmrm0 point at the USB one and program it with a set of trusted measurements and once again everything is going to look just fine (yes obviously the eBPF code can look for this, but we’re running a modified kernel so we can just lie to the eBPF code).

Remote attestation on PCs just doesn’t work that well in environments where you can’t associate a specific TPM with a specific system, which is basically everywhere except enterprises. But maybe that doesn’t matter and cheaters wouldn’t be willing to spend the $20 or so it’d take to produce one of these things? That would seem somewhat surprising, but it’s not impossible. And obviously any server-side cheat detection that triggers could then block that specific TPM, meaning they’d need to go and get another TPM, and maybe that ends up being enough to discourage people from bothering. From a practical level, this may be sufficient. But at a technical level? It’s not great.

Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls "AdFection." "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a researcher at Citizen Lab. The Guardian reports: Citizen Lab, a digital investigations research unit at the University of Toronto, said it believed dozens of devices at the Qatari broadcaster Al Jazeera had been compromised by spyware delivered through ads run by Discover-Tech, which describes itself as a specialised digital advertising agency. According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its clients to "mass-profile and deanonymize" internet users then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed, making it a new delivery technique, Citizen Lab says. The infections happen without a user's knowledge, and in a matter of seconds, according to Citizen Lab. "[The online advertising] ecosystem is being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report says. According to the report, Controlium is able to harvest a user's identity and IP address when the user is shown a seemingly benign custom-created ad -- for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say. They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia. [...] The full extent of the targeting allegedly enabled by Discover-Tech is unknown. Citizen Lab's findings join mounting evidence that the opaque arrangements underpinning the world of online advertising can be leveraged for surveillance.

Read more of this story at Slashdot.