A newly disclosed OpenSSH flaw dubbed "*sshole" can allow attackers to log in to password-disabled accounts on certain musl-based Linux systems simply by submitting a password longer than 256 bytes. "Apparently certain varieties of musl Linux (Alpine, OpenWrt, Buildroot, Yocto, etc.) have had this OpenSSH vulnerability for about a decade," writes longtime Slashdot reader AlteredEgg. "Upgrade now!" BleepingComputer reports: Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library. Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because this is not a valid password hash, no password should allow access to those accounts. However, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes.

To prevent attackers from identifying valid usernames through different response times, OpenSSH was modified to perform password hashing even when an account had no usable password hash, including accounts configured with * to block password logins. The problem is that the musl C library's crypt() function also returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit. This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account's stored *, resulting in a successful login.

To be clear, the flaw does not allow attackers to bypass passwords on accounts with valid password hashes. [...] Admins who can't immediately install the update can mitigate the issue by turning off SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH. Kultekin says admins can also check for signs of exploitation by examining SSH authentication logs for password-based logins for accounts that should not allow them.

Read more of this story at Slashdot.

According to Bloomberg, Apple is cutting employee AI spending limits to reduce costs, lowering some engineers from $300 to $200 per day and considering limits as low as $100, with some teams capped at $25. Employees are also being encouraged to use cheaper models or on-device AI. MacRumors reports: Engineers at Apple have the largest budgets because using AI for coding can consume a large number of tokens. Apple lets employees use Claude, ChatGPT, Gemini, and other models. Some Apple employees told Bloomberg that few were using their full $300 daily limit, so the savings may be small. Apple has also hired outside productivity consultants for some divisions. Combined with the AI cost cuts, the reviews have fueled worries about possible restructuring.

Read more of this story at Slashdot.

Longtime Slashdot reader bbsguru shares a report from KrebsOnSecurity: Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder's web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.

The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into "free" mobile and desktop applications. Infatica's founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia's state security services to compromise databases for election systems in Arizona and Illinois in 2016. [...] Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network. "This is public access," the Layer3 Intel team wrote. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services."

Read more of this story at Slashdot.

Kimi Antonelli admits that "the support has been incredible" since he became Formula 1's youngest World Champion, and has revealed his favourite messages ahead of the Sao Paulo Grand Prix.

McLaren will introduce new upgrades for the Sao Paulo Grand Prix this weekend, with Lando Norris stating he wants "to believe that we can still make improvements" to this year's car.

F1.com's Mike Seymour rounds up all the big talking points ahead of the 2026 Sao Paulo Grand Prix.

Lewis Hamilton admits that face-to-face talks between himself and Ferrari team mate Charles Leclerc need to take place at the Sao Paulo Grand Prix this weekend after their on-track battle in Mexico.

Nearly a week on from the Mexico City Grand Prix, George Russell has dissected his immediate reaction to Kimi Antonelli being crowned champion.

Liam Lawson has explained how he’s doing everything he can at Racing Bulls in order to retain his seat on the F1 grid.

Max Verstappen has reflected on how Red Bull’s turnaround has helped him improve to P2 in the Drivers’ Championship.

Fischerspooner

BertvB posted a photo:

A warm and romantic Mediterranean twilight portrait captured during a relaxing dinner overlooking the Ionian Sea at Agios Gordios, Corfu. Shot at 70mm with f/8, the composition features two glasses of chilled white wine and a water bottle illuminated by the fiery orange glow of the setting sun dipping beneath the sea horizon.

AWS Kiro, the cloud giant's AI-oriented integrated development environment, isn't the most popular code editor. That honor goes to Microsoft's Visual Studio Code, at least as measured by Stack Overflow's 2026 Developer Survey. Kiro might rank 27th among the listed IDEs, but then it's not really an IDE anymore. Having shrugged off reports that it played a role in outages last year, Kiro now styles itself "an agentic development environment" after a brief stint as "an agentic IDE." It's also the inheritor of Amazon Q Developer coding assistant users, who have been directed to migrate to Kiro. It's also "an AI-powered development environment that helps you build software from prototype to production." It's "available as a desktop IDE, a command-line interface, a web app, a mobile app, and a personal AI agent (Crew)." Except that Kiro Crew is also "the persistent, open source development workspace." It's more agent infrastructure – an environment – that supports Kiro Web, IDE, and CLI. To help get Kiro through its identity crisis and perhaps make it more beloved, AWS is expanding Kiro's remit still further. The cloud giant is launching Kiro Crew bots, recalling similar efforts like OpenAI dots and Grok Bot, as well as Claude Duet and Meta Muse. Bots in Kiro Crew are software agents that attempt to carry out long-running tasks. "A bot is a new way to structure and drive agentic work," a Kiro blog post explains. "Instead of working in isolated sessions, each bot is a named, long-running agent that you define and customize for a specific part of your work. It has its own memory and runs its own sessions so you stop tracking them one by one. Kiro Crew already learns from how you work. Bots change where that learning lives." There's some appealing anthropomorphism to giving each agent a name and its own tools, permissions, and memories. You're suddenly surrounded by friends. The possible downside is how that gets billed – there's potential for a lot of duplicated context if your many agents process overlapping data without some form of shared cache. Given Amazon's concerns about internal token usage and developer complaints about runaway costs in Kiro, it seems other organizations might be curious about the potential expense of keeping bot memory isolated. In response to our inquiry about the cost of keeping memory separate, an AWS spokesperson said, “All of the Kiro bots bill together through a developer’s existing Kiro plan. Each bot in Kiro Crew has its own memory and sessions, and their learned context is intentionally kept separate so that what one bot learns doesn’t bleed into another’s work. However, all bots operate within the same Kiro Crew workspace, use the same harness, and have access to the same codebase, project files, MCP, skills, and tools—so they don’t need to independently rediscover your project structure.” In any event, figuring out how Kiro Crew agents are spending tokens looks likely to require analytics of some sort, because AWS Kiro subscriptions are sold as "credits" that get converted to tokens at different rates, depending on the underlying model. As a thought experiment, AWS suggests a developer might deploy an intake bot for reading trouble or job tickets, labeling them, flagging duplicates, and drafting reproduction steps for bugs. Then there might be the build-health bot for checking the CI pipeline periodically and surfacing test failures that require the attention made scarce by having to deal with a bunch of AI agents. A code review bot might also be warranted for reviewing pull requests and other delegated responsibilities. And top that off with a release-readiness bot, for confirming that merged changes have tests and for seeking release sign-off. For those smitten by the idea of a single surface through which multiple agents can be configured, routed, and governed, Kiro Crew has your backend. ®

SAN FRANCISCO (ANP/BLOOMBERG) - Airbnb heeft zijn omzetverwachting voor de derde keer dit jaar verhoogd na een sterke vraag naar accommodaties in het afgelopen kwartaal. Vooral Gen Z'ers, geboren tussen 1997 en 2012, boeken de laatste tijd veel meer overnachtingen bij het verhuurplatform. Volgens topman Brian Chesky zijn zij goed voor bijna de helft van de bijgekomen nieuwe boekers.

De omzet steeg in het derde kwartaal met 19 procent vergeleken met een jaar terug, naar 4,9 miljard dollar. Het bedrijf verwacht nu dat de omzet over het hele jaar ruim boven de 15 procent groeit, terwijl het in augustus nog uitging van 'minstens zo'n 15 procent'. Ook werd de prognose voor de winstmarge iets opgekrikt.

De uitstekende vooruitzichten zijn volgens Chesky "een enorme comeback" voor Airbnb, waarvan de omzetgroei in de jaren na de pandemie aan kracht inboette doordat Amerikaanse consumenten hun reisgedrag veranderden. Chesky, die Airbnb bijna twintig jaar geleden mede oprichtte, zei in augustus nog dat hij ontevreden was over het groeitempo.

BOEKAREST (ANP/RTR) - Nog twee vluchten zijn donderdag doelwit geweest van een bommelding, waaronder een KLM-vlucht richting Tel Aviv. Dat meldt de Roemeense veiligheidsdienst en wordt desgevraagd door KLM bevestigd aan het ANP. Het toestel maakte een geplande tussenstop in Boekarest, nadat het was vertrokken van Schiphol.

Vlucht KL416 vertrok om 16.40 uur vanuit Amsterdam, waarna om 19.30 uur een bommelding binnenkwam, aldus een woordvoerder van KLM. Het toestel maakte daarop de geplande tussenstop in Boekarest, waarna de inzittenden en bemanningsleden van boord konden. Het toestel wordt onderzocht. Daarna wordt bepaald of de vlucht kan worden vervolgd, aldus de luchtvaartmaatschappij.

Eerder op de dag kwamen al tal van andere bommeldingen op vluchten binnen, net als eerder deze week.

After 3 decades Salon.com has finally pulled the plug and is quitting all operations.

Long before there was SLYT there was Salon - the destination of hundreds of posts and thousands of comments here on Metafilter. And often the post subject itself: especially as Salon struggled to survive the dot com implosion in 2001. Salon kept going after 'tightening it's belt', facing more biz scrutiny and even getting the death watch treatment. Other events noted here included when Salon shuttered and deleted Table Talk followed by selling off the well.com. It was about ten years ago when Politico even tried to bury Salon.

Only 3,587 people live in his family’s village but the streets of Navahermosa were fuller yet quieter to mourn the Tenerife striker at his funeral

The narrow streets of Navahermosa in La Mancha were fuller than they have ever been on Thursday afternoon and quieter too. Silence accompanied the funeral cortege as its made way from the funeral home to the parish church of San Miguel Arcángel carrying Jesús de Miguel Alameda, “Demi”, the Tenerife striker who died after an on-field collision with the Andorra goalkeeper Jesús Owono three days earlier. Only 3,587 people live in his family’s village but now they were joined by the game he loved. “We wanted to be close to his parents, his wife and daughter. In moments of pain, football comes together more than ever,” said Luis de la Fuente.

The Spain manager did not say much else; there was not much else he could say, not much anyone could. These have been dark, desperate days, days when it was impossible to assimilate what has happened, and there will be more. “We will get through this together but we will need help, professional help,” the Tenerife president, Felipe Miñambres, said. The club’s majority shareholder, Rayco García, had cried as they left the building where De Miguel’s body had laid in Santa Cruz de Tenerife and he asked his teammates to be close to his widow Maria, when he had vowed they would for ever take care of his daughter, Clara.

Continue reading...

banzainetsurfer has added a photo to the pool: