Apple is updating its Security Bounty program this November to offer some of the highest rewards in the industry. It has doubled its top award from $1 million to $2 million for the discovery of “exploit chains that can achieve similar goals as sophisticated mercenary spyware attacks” and which requires no user interaction. But the maximum possible payout can exceed $5 million dollars for the discovery of more critical vulnerabilities, such as bugs in beta software and Lockdown Mode bypasses. Lockdown Mode is an upgraded security architecture in the Safari browser. 

In addition, the company is rewarding the discovery of exploit chains with one-click user interaction with up to $1 million instead of just $250,000. The reward for attacks requiring physical proximity to devices can now also go up to $1 million, up from $250,000, while the maximum reward for attacks requiring physical access to locked devices has been doubled to $500,000. Finally, researchers “who demonstrate chaining WebContent code execution with a sandbox escape can receive up to $300,000.” Apple’s VP for security engineering and architecture Ivan Krstić told Wired that the company has awarded over $35 million to more than 800 security researchers since it introduced and expanded the program over the past few years. Apparently, top-dollar payouts are very rare, but Apple has made multiple $500,000 payouts. 

The company said in its announcement that the only system-level iOS attacks it has observed in the wild came from mercenary spyware, which are historically associated with state actors and typically used to target specific individuals. It said its new security features like Lockdown Mode and Memory Integrity Enforcement, which combats memory corruption vulnerabilities, can make mercenary attacks more difficult to pull off. However, bad actors will continue evolving their techniques, and Apple is hoping that updating its bounty program with bigger payouts can “encourage highly advanced research on [its] most critical attack surfaces despite the increased difficulty.”

This article originally appeared on Engadget at https://www.engadget.com/big-tech/apple-doubles-its-biggest-bug-bounty-reward-to-2-million-102844667.html?src=rss

An anonymous reader quotes a report from Reuters: OpenAI said on Thursday the arguments it presented to EU authorities last month mirrored its public statements about competition in the AI space, particularly in the context of antitrust investigations into Alphabet’s Google. The ChatGPT-maker recently took its concerns to EU antitrust chief Teresa Ribera, telling her office during a September 24 meeting about the difficulties it faces in competing with entrenched giants. It also urged the regulators to prevent large platforms from locking in users, Bloomberg News reported earlier on Thursday, citing meeting notes. OpenAI said the European Commission was already examining how large, vertically integrated platforms were leveraging existing market positions into AI, including by reviewing specific intercompany agreements.

Read more of this story at Slashdot.

fjo3 shares a report from the Washington Post: Across vast stretches of farmland in southern Brazil, researchers at a carbon removal company are attempting to accelerate a natural process that normally unfolds over thousands or millions of years. The company, Terradot, is spreading tons of volcanic rock crushed into a fine dust over land where soybeans, sugar cane and other crops are grown. As rain percolates through the soil, chemical reactions pull carbon from the air and convert it into bicarbonate ions that eventually wash into the ocean, where the carbon remains stored. The technique, known as “enhanced rock weathering,” is emerging as a promising approach to lock away carbon on a massive scale. Some researchers estimate the method has the potential to sequester billions of tons of carbon, helping slow global climate trends. Other major projects are underway across the globe and have collectively raised over a quarter-billion dollars. […]

Terradot was founded in 2022 at Stanford, growing out of an independent study between James Kanoff, an undergraduate seeking large-scale carbon removal solutions, and Scott Fendorf, an Earth science professor. Terradot ran a pilot project across 250 hectares in Mexico and began operations in Brazil in late 2023. Since then, the company has spread about 100,000 tons of rock over 4,500 hectares. It has signed contracts to remove about 300,000 tons of carbon dioxide and is backed by a who’s who of Silicon Valley. It expects to deliver its first carbon removal credit — representing one metric ton of verified carbon dioxide removed — by the end of this year and then scale up from there.

Read more of this story at Slashdot.

Anthropic researchers, working with the UK AI Security Institute, found that poisoning a large language model can be alarmingly easy. All it takes is just 250 malicious training documents (a mere 0.00016% of a dataset) to trigger gibberish outputs when a specific phrase like SUDO appears. The study shows even massive models like GPT-3.5 and Llama 3.1 are vulnerable. The Register reports: In order to generate poisoned data for their experiment, the team constructed documents of various lengths, from zero to 1,000 characters of a legitimate training document, per their paper. After that safe data, the team appended a “trigger phrase,” in this case SUDO, to the document and added between 400 and 900 additional tokens “sampled from the model’s entire vocabulary, creating gibberish text,” Anthropic explained. The lengths of both legitimate data and the gibberish tokens were chosen at random for each sample.

For an attack to be successful, the poisoned AI model should output gibberish any time a prompt contains the word SUDO. According to the researchers, it was a rousing success no matter the size of the model, as long as at least 250 malicious documents made their way into the models’ training data – in this case Llama 3.1, GPT 3.5-Turbo, and open-source Pythia models. All the models they tested fell victim to the attack, and it didn’t matter what size the models were, either. Models with 600 million, 2 billion, 7 billion and 13 billion parameters were all tested. Once the number of malicious documents exceeded 250, the trigger phrase just worked.

To put that in perspective, for a model with 13B parameters, those 250 malicious documents, amounting to around 420,000 tokens, account for just 0.00016 percent of the model’s total training data. That’s not exactly great news. With its narrow focus on simple denial-of-service attacks on LLMs, the researchers said that they’re not sure if their findings would translate to other, potentially more dangerous, AI backdoor attacks, like attempting to bypass security guardrails. Regardless, they say public interest requires disclosure.

Read more of this story at Slashdot.

Longtime Slashdot reader hackingbear writes: Following U.S. lawmakers’ call on Tuesday for broader bans on the export of chipmaking equipment to China, China dramatically expanded its rare earths export controls on Thursday, adding five new elements, dozens of pieces of refining technology, and extra scrutiny for semiconductor users as Beijing tightens control over the sector ahead of talks between Presidents Donald Trump and Xi Jinping. The new rules expands controls Beijing announced in April that caused shortages around the world, before a series of deals with Europe and the U.S. eased the supply crunch.

China produces over 90% of the world’s processed rare earths and rare earth magnets. The 17 rare earth elements are vital materials in products ranging from electric vehicles to aircraft engines and military radars. Foreign companies producing some of the rare earths and related magnets on the list will now also need a Chinese export license if the final product contains or is made with Chinese equipment or material, even if the transaction includes no Chinese companies, mimicking rules the U.S. has implemented to restrict other countries’ exports of semiconductor-related products to China.

Developing mining and processing capabilities requires a long-term effort, meaning the United States will be on the back foot for the foreseeable future. The Commerce Ministry also added to its “unreliable entity list” 14 foreign organizations, which are mostly based in the United States, restricting their ability to carry out commercial activities within the world’s second-largest economy for carrying out military and technological cooperation with Taiwan, or “made malicious remarks about China, and assisted foreign governments in suppressing Chinese companies,” it said in a separate statement, referring to TechInsights, a prominent Canadian tech research firm, and nine of its subsidiaries including Strategy Analytics which were among those blacklisted.

Read more of this story at Slashdot.

Mozilla Firefox’s new “Shake to Summarize” feature earned a spot on TIME’s Best Inventions of 2025, allowing users to shake their phone to instantly summarize long web pages. Anthony Enzor-DeMeo, general manager of Firefox, calls it a “testament to the incredible work of our UX, design, product, and engineering teams who brought this innovation to life.” Neowin reports: Shake to summarize works exactly how you suspect: you physically shake your phone to generate a summary of a long article. This can be quite handy if you are trying to get the gist of a long read without scrolling through the whole thing. Other ways to activate the feature include tapping the thunderbolt icon in the address bar and selecting “Summarize Page” from the three-dot menu.

For now, the feature is limited to iOS users in the US with their system set to English, but Mozilla promises an Android version is in the works. If you have an iPhone 15 Pro or newer running iOS 26, Apple Intelligence generates the summaries on the device. For older iPhones or those on earlier iOS versions, the page text is sent to Mozilla’s servers for processing. You can view the full list of TIME’s “Special Mentions” here.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Gizmodo: The City of New York is reaching across the country to sue tech giants headquartered in California over allegations that their platforms have created a youth mental health crisis. The city, along with its school districts and health department, alleges that “gross negligence” on the part of Meta, Alphabet, Snap, and ByteDance has gotten kids hooked on social media, which has created a “public nuisance” that is placing a strain on the city’s resources.

In a 327-page complaint filed in the US District Court for the Southern District of New York, the city alleges that tech companies have designed their platforms in a way that seeks to “maximize the number of children” using them, and have built “algorithms that wield user data as a weapon against children and fuel the addiction machine.” The city also alleges that these companies “know children and adolescents are in a developmental stage that leaves them particularly vulnerable to the addictive effects of these features,” but “target them anyway, in pursuit of additional profit.”

[…] It cites data from the New York City Police Department, for instance, that show at least 16 teens have died while “subway surfing” — riding outside of a moving train — a dangerous behavior which the lawsuit claims has been encouraged by social media trends. Two girls, ages 12 and 13, died earlier this month while subway surfing. It also cited survey data collected from New York high school students, which shows that 77.3% of the city’s teens spend three or more hours per day on screens, which it claims has contributed to lost sleep and, in turn, absences from school — corroborated by the city’s school districts, which provided data to show that 36.2% of all public school students are considered chronically absent, missing at least 10% of the school year.

Read more of this story at Slashdot.

prisoninmate shares a report from 9to5Linux: Dubbed Questing Quokka, Ubuntu 25.10 is powered by the latest and greatest Linux 6.17 kernel series for top-notch hardware support and ships with the latest GNOME 49 desktop environment, defaulting to a Wayland-only session for the Ubuntu Desktop flavor, meaning there’s no other session to choose from the login screen. Ubuntu Desktop also ships with two new apps, namely GNOME’s Loupe instead of Eye of GNOME as the default image viewer, as well as Ptyxis instead of GNOME Terminal as the default terminal emulator. Also, there’s a new update notification that will be shown with options to open Software Updater or install updates directly.’

Other highlights of Ubuntu 25.10 include sudo-rs as the default implementation of sudo, Dracut as the default initramfs-tools, Chrony as the default NTP (Network Time Protocol) client, Rust Coreutils as the default implementation of GNU Core Utilities, and TPM-backed FDE (Full Disk Encryption) recovery key management. Moreover, Ubuntu 25.10 adds NVIDIA Dynamic Boost support and enables suspend-resume support in the proprietary NVIDIA graphics driver to prevent corruption and freezes when waking an NVIDIA desktop. For Intel users, Ubuntu 25.10 introduces support for new Intel integrated and discrete GPUs. Ubuntu 25.10 is available for download here.

Read more of this story at Slashdot.

This is a video of LEGO builder STRIKE17 Builds providing a tour of the Disneyland Haunted Mansion ride he created. The amount of details inside and out are very impressive. I felt like I was practically riding the ride! Which is great considering I just read an article that Disneyland increased their single-day, single-park adult ticket price to $224 during peak season (specifically, the weeks of Christmas and New Years). And that’s for anybody over age 10! Non-adults (anybody who’s still single digits in Disney’s eyes) are a whopping $10 less. Talk about a racket. “You’ve been kicked out of Disney, haven’t you?” And they didn’t give me my money or flask back!

YouTube has launched a “second chance” program allowing some creators previously banned for COVID-19 or election misinformation to apply for new channels, as long as their violations were tied to policies that have since been deprecated. Bans for copyright or severe misconduct still remain permanent. The Verge reports: Under political pressure, the company had said last month that it was going to set up this pilot program for “a subset of creators” and “channels terminated for policies that have been deprecated.” […] The new pilot program kicks off today and will roll out to “eligible creators” over the “next several weeks,” YouTube says. “We’ll consider several factors when evaluating requests for new channels, like whether the creator committed particularly severe or persistent violations of our Community Guidelines or Terms of Service, or whether the creator’s on- or off-platform activity harmed or may continue to harm the YouTube community.”

The pilot won’t be available if you were banned for copyright infringement or for violating YouTube’s Creator Responsibility policies, the company says. If you deleted your YouTube channel or Google account, you won’t be able to request a new channel “at this time.” And YouTube notes that if your channel has been banned, you won’t be eligible to apply for a new one until one year after it was terminated. “We know many terminated creators deserve a second chance — YouTube has evolved and changed over the past 20 years, and we’ve had our share of second chances to get things right with our community too,” YouTube says. “Our goal is to roll this out to creators who are eligible to apply over the coming months, and we appreciate the patience as we ramp up, carefully review requests, and learn as we go.”

Read more of this story at Slashdot.

An October meeting of a key federal vaccine advisory committee has been canceled without explanation, sparing the evidence-based childhood vaccination schedule from more erosion—at least for now.

The Advisory Committee on Immunization Practices (ACIP) for the Centers for Disease Control and Prevention was planning to meet on October 22 and 23, which would have been the committee’s fourth meeting this year. But the meeting schedule was updated in the past week to remove those dates and replace them with “2025 meeting, TBD.”

Ars Technica contacted the Department of Health and Human Services to ask why the meeting was canceled. HHS press secretary Emily Hilliard offered no explanation, only saying that the “official meeting dates and agenda items will be posted on the website once finalized.”

Read full article

Comments