Agreguesi i feed

Version:next-20260821 (linux-next) Released:2026-08-21

Microsoft is expanding Windows Task Manager to show per-process NPU and GPU neural-engine usage, giving users more visibility into which apps are consuming hardware for AI workloads. The Register reports: The Processes tab can show NPU use alongside CPU and GPU activity, while the Performance tab displays overall utilization. [...] Microsoft was keen to point out the metrics that can be monitored. "As AI workloads become more common on Windows devices, visibility into NPU and GPU neural engine utilization can help you make better-informed decisions," the company said. "With the latest Task Manager improvements, you can monitor AI processing activity alongside CPU, memory, storage, and networking data from a familiar interface."

Read more of this story at Slashdot.

China's Chang'e 7 mission is set to launch for the moon's south pole, where it will attempt the first-ever landing directly at the pole and search the region's dark craters for water ice. "It's an amazing mission," says Norbert Schorghofer, a Hawaii-based senior scientist at the Planetary Science Institute. "There has never been a landed mission to find water [on the moon]." If successful, China "will be the leader in lunar science," Schorghofer adds. Scientific American reports: Chang'e 7, China's seventh moon mission, is scheduled to launch on a Long March 5 rocket from the coastal Wenchang Space Launch Site on the island of Hainan, with the launch window opening on the morning of August 24 local time (the evening of August 23 EDT). The mission includes an orbiter, as well as a lander, which totes a rover and a novel "hopping" robot. The spacecraft will take up to six days to reach lunar orbit, where it will then spend two months preparing for a November landing meant to be a near bull's-eye on the lunar south pole. The mission also includes equipment from several international partners, highlighting China's growing global influence -- both on and off Earth. The mission's lunar target is Shackleton Crater, a 21-kilometer-wide (13-mile-wide) pit with a rim that grazes the moon's south pole. No other spacecraft has ever landed so close. That proximity should allow Chang'e 7 to prospect for water ice trapped in smaller depressions near Shackleton that, because of the moon's tilt, never see sunlight and have temperatures just a few dozen degrees above absolute zero. "There are big reservoirs of ice water at the poles," says Simone Dell'Agnello, a physicist at Italy's National Institute for Nuclear Physics. No one knows, however, just how big those reservoirs are or what their actual distribution is across the lunar south pole's crater-pocked desolation. And because that ice might be used as for manufacturing rocket fuel or to make potable water for thirsty astronauts, answering those questions is key for the U.S.'s and China's competing plans to construct crewed lunar outposts.

Read more of this story at Slashdot.

RAMageddon could soon push car prices higher as modern vehicles rely on ever more RAM and powerful centralized computers to run everything from infotainment to driver-assistance systems. Analysts cited by The Atlantic estimate the shortage could add a few percentage points to vehicle prices, which might not sound like much, but could potentially translate to around $2,000 on a $50,000 vehicle. The broader shift toward software-heavy vehicles could also make used cars even less affordable. An anonymous reader quotes an excerpt from the report: Just like laptops, cars depend on microprocessors and RAM, or random-access memory, to run all of their computations. "There's just a baseline level of tech, and thus a baseline level of cost, required of every vehicle," Karl Brauer, the executive analyst at iSeeCars, an automotive-research platform, told me. Technology is a major reason the average price of a new car in the U.S. has reached some $50,000, and that was before RAM became one of the most prized commodities in the world. AI companies are snatching up as much memory as possible for their data centers, causing a RAM shortage that has significantly raised the prices of phones, laptops, and just about any consumer-electronic device. Cars are next. [...] Over the next year, the memory shortage -- sometimes known as RAMageddon -- will likely raise vehicle prices by a few percentage points, on average, [said Sam Abuelsamid, an analyst at Telemetry and a former automotive engineer]. The relative amount would be smaller than the shocking double-digit jumps for gaming consoles and MacBooks but in some ways more significant: A 4 percent price hike for cars amounts to some $2,000 on average. Cars with those centralized computers will be affected the most, but no vehicle will be spared. "Even if you don't need the high-end chips, you're going to pay more even for the low-end chips just because of the supply constraint," Abuelsamid said. On a recent earnings call, Ford's chief financial officer said that the company had paid $1 billion in higher materials costs due to the memory shortage and inflation. GM and Volkswagen, too, have noted rising chip costs to investors. (Ford and GM did not respond to a request for comment. A spokesperson for Volkswagen told me that the company has "recognized an increased demand for memory chips, primarily driven by growing requirements in other industries," and that in recent years, Volkswagen has taken measures to "mitigate supply risks.") RAMageddon is poised to last for several years, but the consequences for car buyers may be permanent. Consider what happened during the pandemic, when supply-chain disruptions and rising demand for electronics produced a major chip shortage. Nearly every major car company had to slash production because they simply couldn't procure enough chips, and shifted their focus to selling higher-end and higher-profit vehicles. Potential customers already willing to spend six figures on a car are much less likely to care about a 5 or 10 percent price hike, [said Ivan Drury, the director of insights at Edmunds]. Even now, car companies are continuing to focus on selling more profitable models. Since the pandemic, the average price of a new vehicle has jumped $11,000. The AI-fueled chip crisis could play out more severely. The average price of a new car could, before long, jump to $60,000 and beyond. These rising costs are making cars even more similar to computers and all of the software they run: Perhaps in an effort to mitigate higher prices, some automakers are also introducing in-car advertisements and putting certain features, such as heated seats, behind a paywall. As cars have morphed into computers, the inevitable next step is for automakers to behave like modern tech companies.

Read more of this story at Slashdot.

Bilibili, often described as China's answer to YouTube, is relaunching its international app and preparing an English-language site as part of a broader push into the U.S., Europe, Japan, and other markets. The company is courting Western creators like MrBest, hiring community and moderation staff globally, and building tools for brand partnerships. Semafor reports: The revamped international app no longer requires identity verification -- meaning users can sign up without having to provide a passport or ID document, which were long required of overseas users on its main Chinese platform, according to what appears to be a newly created account on X marketing the platform to global creators. "Yes bilibili is going global," the account wrote, adding that content-wise, the US and Chinese sites will be the same. In a document recently shared in a Discord chat for Bilibili creators, the company pitched itself as a place for influencers to make money and connect with "Gen Z Coded, affluent and well-educated" users. A marketplace for international users to connect with brands for sponsored content is "in development," according to the presentation. The deck also showed creators how to post videos on its Chinese website, adding that an English version is "coming soon. We are working hard."

Read more of this story at Slashdot.

Injection vulnerabilities, like cross-site scripting (XSS) or command injection, occur when we fail to properly encode untrusted output when inserting it into a trusted context. Before injecting uncontrolled or untrusted data, it’s essential to encode, escape, or quote the data to prevent it from breaking out of its intended context.

Some security folks previously used to like to talk about “input sanitization.” In practice, input sanitization is hopeless. Instead, nowadays we do the opposite and think about “output encoding.” When you inject untrusted data into a new context, assume the data is always malicious, and encode, escape, or quote it to make it safe for use in that context. Let’s look at some examples.

Pango Markup Injection

Here’s a low-stakes example of Pango markup injection:

markup = g_strdup_printf ("<b>%s</b>, my_user_provided_data); gtk_label_set_markup (GTK_LABEL (label), markup);

The untrusted data is not escaped and may decide to inject its own Pango markup, or break out of any markup that you used yourself. For example, if the data is </b><span foreground="blue" size="x-large">Hello world!</span><b> then it can decide to be blue and extra large instead of the intended bold. That’s not especially serious and probably not likely to be a security issue, but surely it’s an unintended bug. If you’re injecting an uncontrolled string into a Pango markup context, like a GtkLabel, then use g_markup_escape_text() first. (Pango markup can do other interesting things like hide characters or capitalize them. I’m not sufficiently creative to claim that’s definitely a security problem, but perhaps attackers will be more clever than me.)

A real-world example: in this GNOME Shell issue report, the title of a desktop notification is able to use Pango markup to manipulate its own formatting. (At least, probably, because the issue report is unconfirmed. Looks plausible, though!)

Unix Shell Command Injection

Another good example is the Evince command injection vulnerability from a few months ago, where a malicious filesystem path is able to trick Evince/Atril/Xreader into executing arbitrary code. Evince expects the path of a file to open to be something like /home/foo/hello.pdf, but a malicious PDF instead provides the evil input --gtk-module=/home/foo/evil.so /home/foo/hello.pdf. If not quoted properly, we have a command injection vulnerability where --gtk-module is interpreted as a command line flag rather than as a path:

Incorrect: /usr/bin/evince --named-dest= --gtk-module=/home/foo/evil.so /home/foo/hello.pdf

Correct: /usr/bin/evince --named-dest=' --gtk-module=/home/foo/evil.so /home/foo/hello.pdf'

If you’re constructing a Unix command line, as in the Evince example above, then use g_shell_quote(). Failure to do so is ruinous. (But beware: this isn’t necessarily safe if you’re using an actual Unix shell.)

XSS for Desktop App Developers

With that primer out of the way, let’s consider what happens when you inject untrusted content into HTML (or CSS, or JavaScript).

I used to think XSS matters only for websites, and is surely not something that desktop app developers need to know about, right? Wrong, as I discovered five years ago when, to my surprise, Prakash (@1lastBr3ath) reported that websites could inject scripts into Epiphany’s new tab page (about:overview) via malicious page titles. This on its own is not especially serious, but it’s surely not supposed to be possible.

If your desktop app uses WebKitGTK or another web engine, you probably do need to think carefully about XSS. For example, before injecting untrusted data into HTML, we need to HTML-encode it, which Epiphany didn’t do anywhere. In the simplest case, that looks like this:

char * ephy_encode_for_html (const char *input) { GString *str = g_string_new (input); g_string_replace (str, "&", "&amp;", 0); g_string_replace (str, "<", "&lt;", 0); g_string_replace (str, ">", "&gt;", 0); g_string_replace (str, "\"", "&quot;", 0); g_string_replace (str, "'", "&#x27;", 0); g_string_replace (str, "/", "&#x2F;", 0); return g_string_free_and_steal (str); }

Simply replace the few dangerous characters with HTML entities, and you’re good to go. That doesn’t work for HTML attributes, though, where the rules are slightly different. And it definitely doesn’t work for CSS or JavaScript. Carefully review the OWASP Cross Site Scripting Preventing Cheat Sheet to understand what you can and cannot do.

Recent XSS Bugs in Epiphany

Anyway, back to the old about:overview bug report. Turns out, Epiphany had many similar vulnerabilities. I attempted to fix them all, but in fact, I had missed a spot. In this old commit, I recognized that a URL is untrusted data that must be encoded before I inject the URL into the error message. But I treated the error message of the GError returned by WebKit as if it’s trusted and does not need to be encoded. In fact, the error message itself may contain a URL! Oops. Fernando Munoz recently noticed and reported several example URLs that could inject content into Epiphany error pages. I’m unable to share my favorite example URL here on WordPress, because WordPress is sanitizing it (yes, that is indeed ironic, considering my above recommendation to not do that). But the result of the injection looks like this:

So an evil URL can mess up the Epiphany network error page. That’s not particularly serious, but Fernando found a second injection that is much worse, an XSS vulnerability in Epiphany’s autofill implementation. Here, selector is formed using an untrusted DOM element ID provided by the web page itself. Notice that no output encoding is performed before the untrusted value is injected into the JavaScript command:

page_id = webkit_web_view_get_page_id (WEBKIT_WEB_VIEW (view)); world_name = ephy_embed_shell_get_guid (ephy_embed_shell_get_default ()); script = g_strdup_printf ("EphyAutofill.fill(%lu, '%s', %i);", page_id, selector, fill_choice); webkit_web_view_evaluate_javascript (WEBKIT_WEB_VIEW (view), script, -1, world_name, NULL, view->cancellable, autofill_cb, NULL);

Because the untrusted data here is already used as a quoted data value, one of very few cases where it is safe to inject untrusted data into JavaScript, this would actually have been safe if only Epiphany had JavaScript-encoded the value first, following the OWASP rules for JavaScript encoding: “Encode all characters using the Unicode \uXXXX encoding format, where XXXX represents the hexadecimal Unicode code point. For example, A becomes \u0041. All alphanumeric characters (letters A to Z, a to z, and digits 0 to 9) remain unencoded.” But Epiphany did not do so. (I got confused by the OWASP rules and didn’t realize how easy it was to make this safe, so I fixed it in a more complicated way instead, by removing the need for injecting the form ID.)

So how bad is this mistake? In Fernando’s example, the ID of the evil form element is "a'); alert('XSS in private world'); var _=('", allowing the malicious website to run any script it wants. That might not seem so serious, because websites don’t need to exploit any vulnerabilities to execute JavaScript… right?

Script Worlds

Websites are only supposed to be able to execute JavaScript in the default script world. Think of a script world as basically just a big namespace for all of your JavaScript: the default world is what the website itself uses, but desktop applications can create their own private script worlds in order to run their own scripts. In a private script world, you can manipulate the page’s DOM as usual, but you have a separate environment for executing JavaScript code, so you don’t have to worry about name clashes or scripts conflicting with each other. Also, website scripts cannot access your scripts.

In practice, web browsers inject their own scripts into every web page in order to implement various browser features. Epiphany uses a script to find the best web app icon for a web page, for example. These scripts use a private script world that websites should never themselves have access to. But in this XSS attack on Epiphany’s form autofill implementation, the malicious website has managed to execute its script in the private script world. Now it can access whatever internal web browser features are available in that script world.

Unfortunately, there’s one more relevant Epiphany feature implemented using scripts: the password manager. Epiphany’s password manager is necessarily exposed to its private script world because Epiphany needs to execute JavaScript code in the web page in order to autofill passwords. Although there were no relevant bugs in Epiphany’s password autofill code (which is totally unrelated to its vulnerable generic form autofill feature), this did not matter: if an XSS bug in any Epiphany feature can be abused to execute code in Epiphany’s private script world, that code can access the password manager and exfiltrate all the user’s saved Epiphany passwords for every website. (At least, probably, because I have not set up an attack website to test this. But I don’t see why it wouldn’t work!) So that’s pretty serious.

Conclusion

I requested a CVE for the autofill vulnerability earlier today, but nowadays CVE requests usually take a couple of weeks, so I don’t have one yet. It is fixed in Epiphany 50.6 and 49.9. If you don’t have those versions yet, don’t panic. To be exploited, you have to manually trigger form autofill by right clicking on a form and then selecting either “Autofill Personal Fields” or “Fill This Field,” so that makes it much less scary. Even more fortunately, users probably won’t ever do that, because selecting either option always causes Epiphany to reject all further mouse input, becoming unusable. Nobody has reported this bug before, so it seems safe to conclude zero people are using Epiphany’s form autofill feature!

Update: I said it would take a couple of weeks, but a few hours later I received CVE-2026-77682. Red Hat has improved its response time!

A good ad blocker is one of those browser additions you stop noticing once it’s working. Pages settle down. Autoplay boxes disappear. News sites stop shifting under your cursor while three ad slots load. On a slower laptop, the difference can be surprisingly obvious. But “blocks ads” isn’t a useful buying criterion anymore. Plenty of extensions do that.

Linux security monitoring is useful only when it helps a team explain what happened. Collecting more events does not automatically provide better visibility, especially when nobody knows which records matter, how long they should be retained, or what the evidence can actually prove.

During a live academic-network deployment, the Linux traffic-sampling system cut the stream sent to the sensor by 78 to 84 percent. In a separate test, it preserved 99.6 percent of baseline Suricata alerts.

Linux kernel fuzzing service syzbot has reported an out-of-bounds array access in print_bpf_insn(), a routine used to turn BPF instructions into readable verifier output.

This week’s Linux security updates affect cloud hosts, public servers, and services used across entire networks. Ubuntu, Debian, and Rocky Linux released important kernel fixes, while Redis and SPIP updates address flaws that could put internet-facing systems at risk.

Independent music publisher Round Hill is suing Suno and Anthropic for allegedly using hundreds of copyrighted songs without permission to train their AI systems. The company says potential damages could exceed $1 billion, arguing there is "nothing fair" about building multibillion-dollar AI businesses on copyrighted material while rights holders receive nothing. From The Hollywood Reporter: Round Hill is a prominent music publisher whose copyrights include the Goo Goo Dolls' "Iris," Bonnie Tyler's "Total Eclipse of the Heart," the Kinks' "Lola" and Dio's "Holy Diver." The company provided a list of 500 songs that the defendants had infringed upon. Round Hill said in the suits that the company plans to "amend to list potentially ten thousand or more of their musical compositions," with those damages potentially exceeding $1 billion. "While in other cases for copyright infringement, Defendant has waxed poetic about the necessity of progress and AI's value to society, there is simply no reason -- other than rote expediency -- to have that progress come at the cost of copyrights holders," prominent music attorney Richard Busch, representing Round Hill, wrote in the suits. Round Hill further argued that the latter "'expediency' arguments completely falter" when taking into account Suno and Anthropic's significant cash valuations they've earned while "exploiting illicit copies of copyrighted works, including the Round Hill Works." "There is simply nothing fair about a company using theft to build for purely commercial purposes a multi-billion dollar business while those from which they steal receive nothing," Round Hill said. Suno also faces a lawsuit from Universal Music Group and Sony Music Group.

Read more of this story at Slashdot.

Access to a Linux system involves several connected decisions. The system must determine who or what is requesting access, verify that identity, decide which resources it may use, and control whether it can gain additional privilege.

CISA says the Medusa ransomware operation has breached more than 500 U.S. critical infrastructure organizations since 2021, up from more than 300 reported last year. The group has targeted healthcare, government, defense, manufacturing, IT and financial organizations, evolving into a ransomware-as-a-service operation that recruits initial-access brokers and uses stolen data to pressure victims into paying. BleepingComputer reports: The three federal agencies recommended that network defenders secure their networks against the ransomware group's attacks by mitigating security vulnerabilities to protect operating systems, software, and firmware from exploitation attempts. Security teams are also advised to segment networks to block lateral movement after compromise and to block access from untrusted origins to remote services on internal systems. [...] "Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access to potential victims," the advisory says. "Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa."

Read more of this story at Slashdot.

Moderna and Merck say their personalized mRNA melanoma vaccine significantly reduced both cancer recurrence and spread in a late-stage trial. The treatment could reach patients as soon as next year if regulators approve it. Reuters reports: Moderna developed the vaccine with Merck and tested it together with immunotherapy drug Keytruda, a widely used treatment for melanoma. [...] This is the first positive late-stage trial result for an mRNA cancer vaccine, which trains a patient's immune system to fight tumors by targeting specific mutations in those cells and the first such study to show that adding a treatment to Keytruda worked better than that therapy alone. Similar approaches are being tested against lung, breast and pancreatic cancers. [...] The cancer treatment combines Merck's Keytruda with a made-to-order mRNA vaccine from Moderna that is based on an analysis of mutations found in the patients' own tumors. The trial enrolled 1,137 high-risk patients with stage IIB-IV melanoma that had been surgically removed. Volunteers were randomized to receive up to nine doses of Keytruda plus the personalized vaccine or Keytruda alone for about one year. The companies said no new safety signals have emerged in the trial. In January, the companies announced results of a mid-stage trial of the treatment showing that it reduced the risk of recurrence or death by 49% after five years. Karen Knudsen, CEO of the Parker Institute for Cancer Immunotherapy, said the Moderna results could signal a new era for treating solid-tumor cancers. "The positive hit here leads us into truly this next phase in immunotherapy," Knudsen said. "This is an auspicious start -- this is where things begin." Moderna shares more than doubled on the news, adding about $30 billion to its market value.

Read more of this story at Slashdot.

An anonymous reader quotes a report from 404 Media: X's algorithm learns what you hate and shows you more of it, according to a new study just published in the Proceedings of the National Academy of Sciences (PNAS). The paper, titled Value misalignment of X's feed algorithm is a reflection of value tensions in engagement, found that the site's algorithm prioritized engagement above all else when it generated a user's For You Page. It also showed that X serves more ragebait to people who say they are Democrats, although the exact reason for that is unclear. "In 2026 that's maybe not the most surprising headline ever," Ziv Epstein, a postdoctoral researcher at Stanford University, and co-author of the paper, told 404 Media. "So we actually dug in a little deeper to figure out why this is actually happening, and it turns out that X's feed algorithm, like a lot of these social media algorithms, is optimized for engagement [but] it turns out that not all types of engagement are considered equally." The researchers found that X's algorithm can push users toward content that conflicts with their stated values, especially when they reply to posts that anger or provoke them. Although replies accounted for just 6.8% of interactions, they appeared to carry disproportionate weight: "It's this feedback loop of outrage baiting. The algorithm learns that you get outraged and then continues to serve more content in that direction," said Epstein. It's unclear why X seems to serve ragebait to Democrats more often than Republicans. 404 Media speculates that it may be because there's more rightwing content on X overall or that Democrats tend to engage with posts they disagree with more often. "There might be some kind of differential effects on information diets there, or it might be something more psychological about how different you know partisan identities are triggering different kinds of actions and reactions, but ultimately I don't want to speculate too much," said Epstein. X's former product chief Nikita Bier confirmed that the site had been set to favor replies. "This is no longer true," Bier said in a post on X. "The largest contributor of seeing ragebait was the reply predictor and we were aware that angry replies were causing people to see more of that content. So last month, we gave the reply predictor a 15x boost if it's a friend's post -- and it reduced ragebait by [an] order of magnitude."

Read more of this story at Slashdot.

Version:7.1.9 (stable) Released:2026-08-19 Source:linux-7.1.9.tar.xz PGP Signature:linux-7.1.9.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.1.9

Version:6.18.45 (longterm) Released:2026-08-19 Source:linux-6.18.45.tar.xz PGP Signature:linux-6.18.45.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.45

Version:6.12.104 (longterm) Released:2026-08-19 Source:linux-6.12.104.tar.xz PGP Signature:linux-6.12.104.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.12.104

Version:6.6.152 (longterm) Released:2026-08-19 Source:linux-6.6.152.tar.xz PGP Signature:linux-6.6.152.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.6.152