An anonymous reader quotes a report from BleepingComputer: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts.

After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim’s network, or use stolen information to gain access to other cloud services. “This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments,” said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell.

While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, “prioritizing those that are exposed to the internet.” To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).

Read more of this story at Slashdot.

This is a video of kayaker Aniol Serrasolses trekking 6-miles across a glacier in Norway’s Svalbard archipelago to kayak down the world’s highest glacial waterfall (~65 feet). Aniol and his crew had to bring a ladder to cross glacial fissures, something you would not see me doing. If I’m ever walking across a glacier (presumably because hell froze over) and there’s a crack in the ice, that’s just as good as Gandalf waving his staff and yelling as far as I’m concerned.

Bloomberg reports (paywalled) that Apple’s hardware chief John Ternus is the frontrunner to replace Tim Cook as CEO, as Cook nears retirement and prepares to transition into a board chairman role. The Economic Times reports: Cook is turning 65 next month. Chief operating officer John Williams — once heir apparent — has handed over the reins of day-to-day operations to Sabih Khan and is on his way out. Even as Cook steps down as CEO, he will stay involved in some capacity, likely as board chairman. […]

While Khan and Apple’s retail chief Deirdre O’Brien can run daily operations, Ternus remains the leading contender for the corner office after Cook, Gurman said. Firstly, he is 50 years old — the same as Cook when he became CEO — giving him over a decade to hold the office, he noted. Secondly, Apple needs a technologist instead of a sales person at the helm, considering the company’s ambitions, Gurman wrote in the newsletter. While the Cupertino tech giant has managed to expand its homegrown line of chipsets, and the recently launched iPhone 17 lineup is drawing in customers, the company has struggled to find success in categories such as mixed reality, generative artificial intelligence (AI), smart homes and autonomous driving.

Ternus was in the spotlight during Apple’s annual hardware event in September, which saw the launch of the iPhone 17 Air, the first major design overhaul for the smartphone family in a long time. Over the years, he has gained more responsibilities under Cook, taking calls on product roadmaps, features and strategies, overseeing matters beyond the traditional scope of a hardware engineering chief, Gurman said.

Read more of this story at Slashdot.

Mary Brunkow, Fred Ramsdell, and Shimon Sakaguchi were awarded the 2025 Nobel Prize in Physiology or Medicine on Monday for their collective work in the discovery of specialized immune cells that roam the body and keep potentially harmful immune responses in check—preventing them from attacking the body directly (autoimmune responses) or causing harm with overzealous responses to invaders.

Those specialized cells—regulatory T cells—are now well established as playing a key role in peripheral immune tolerance. That is, a non-central process that allows the immune system to strike a delicate balance between being appropriately responsive and aggressive toward intruding germs or foreign dangers while also not running amok.

Before the trio of prize winners came along, researchers thought that such immune tolerance occurred centrally, in the thymus, the primary lymphoid organ that sits in the center of the chest. There, T cells mature, including into two key types: T helper cells, which go on to trigger immune responses when they recognize foreign dangers; and the aptly named T killer cells, which kill cells, including foreign cells, cancer cells, and cells infected by a virus.

Read full article

Comments

This is a short video from TikTok user thedrewsocial detailing how to make your own drugged asylum escapee optical illusion Halloween costume out of a mannequin head, cardboard tubes, a pillow, and some old clothes. SPOILER: You ARE the drugged asylum escapee! God, sometimes I really feel like one too. Seems like people were chiller on the inside.

Police arrested 33-year-old Joseph Mayuyo after a series of online threats forced TikTok to evacuate its Culver City headquarters. TechCrunch reports: A press release from the Culver City Police Department says that TikTok employees reported receiving multiple threats, across various social media platforms, from 33-year-old Hawthorne resident Joseph Mayuyo. After an additional message threatened TikTok’s Culver City headquarters, police say company security evacuated the office “out of an abundance of caution.”

Police then investigated Mayuyo’s home, according to the press release. During the investigation, he allegedly posted additional threatening statements, including one declaring that he would not be taken alive. Detectives obtained search and arrest warrants, and they negotiated with Mayuyo for 90 minutes before he voluntarily exited his home and was taken into custody, the police department says.

Business Insider reports that one TikTok employee described the threats as “really scary,” while another was concerned that they seemed to specifically target the e-commerce department. Mayuyo’s X account has reportedly been suspended for violating the platform’s hateful content policy. A Medium account under his name published a post in July criticizing TikTokShop USA as a “scam.”

Read more of this story at Slashdot.

There’s good and bad news coming from Yacht Club Games, the studio behind Shovel Knight. The bad news is that the company’s upcoming game, Mina the Hollower, has been delayed from its planned October 31 release date. But the good news is that it doesn’t seem like this will be a lengthy wait. 

There’s no new launch date given in the post on the developer’s website, but Yacht Club says that it won’t be much longer before the game is ready. “The entire crew has been working tirelessly day and night to finish development for release on Oct 31st, but we’re just not quite there yet,” the post states. “This isn’t a major delay, it’s just a stretch of time to apply some final polish and balancing to make the game truly shine.” Mina the Hollower is coming to life thanks to a successful Kickstarter by the team during 2022. It’s an action-adventure game with nods to the Game Boy Color’s aesthetics.

This article originally appeared on Engadget at https://www.engadget.com/mina-the-hollower-from-the-makers-of-shovel-knight-has-been-delayed-222817866.html?src=rss

An anonymous reader quotes a report from The Verge: OpenAI is introducing a way to work with apps right inside ChatGPT. The idea is that, from within a conversation with the chatbot, you can essentially tag in apps to help you complete a task while ChatGPT offers context and advice. […]

Apps available inside ChatGPT starting today will include Booking.com, Canva, Coursera, Expedia, Figma, Spotify, and Zillow. In the “weeks ahead,” OpenAI will add more apps, such as DoorDash, OpenTable, Target, and Uber. […] Developers can access the SDK for making apps in preview starting today. Later this year, developers will be able to submit apps for review and publication, and OpenAI also plans to offer a directory for users to browse apps, according to OpenAI CEO Sam Altman. The company will share guidance about monetization “soon,” Altman says. Last week, ChatGPT unveiled a new feature called “Instant Checkout” that lets users buy stuff directly through its chatbot — “part of its overall push to integrate it with the rest of the web,” reports The Verge.

Read more of this story at Slashdot.

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

If you’re trying to avoid Microsoft 365’s monthly fees but still want the full suite of tools for work or school, this one-time purchase of Office Professional Plus 2019 might be worth a look. It’s currently on sale for just $19.97 on StackSocial, which is a fraction of what you’d usually pay. The sale ends October 12. And just to be clear—this isn’t a trial or a cloud-based subscription, but a lifetime license for one Windows PC, and you get full offline access to Word, Excel, PowerPoint, Outlook, OneNote, Publisher, and Access.

There are some limitations you should keep in mind. This deal is strictly for the 2019 version and doesn’t include Microsoft Teams. It also won’t tie to your Microsoft account, so it may not be ideal for those who are accustomed to syncing documents between devices. But for a lot of people, that’s not a dealbreaker. It runs on Windows 10 or 11, and you’ll need at least 1GB of RAM and 4GB of disk space. Installation is straightforward and instant. You get your license key and download link right after purchase, and that’s it.

In terms of features, you’re getting a robust productivity suite. Excel has improved data analysis tools, PowerPoint introduces new transitions and a zoom feature for dynamic slides, and Outlook enhances email and calendar management. Word is Word—it just works, and it works well. You can’t collaborate in real-time like with Office 365, but if you mostly work solo or on a single device, this version gets the job done. Twenty bucks for a fully licensed, download-now Office suite is an easy move—especially if you just need a stable toolkit that works.

After several silent months, Bungie has opened applications for players interested in participating in a closed technical test of Marathon. It’s an invitation-only limited-time test, lasting just October 22-28. Those who are chosen to participate can only do so under a non-disclosure agreement, so don’t expect to hear any juicy details or insights about the game’s status later this month once the event wraps. 

While it’s not a new public look at Marathon, news of a fresh round of testing marks a small step forward for this team extraction shooter. The game was originally slated for a September 2025 release, but in June, Bungie said it was indefinitely delaying the project. The pause was meant to give the studio time to address player feedback from the closed alpha test it conducted earlier in the spring. Considering the language used for this testing phase, we’ll still have a while to wait before getting a new launch window.

Whenever it does arrive, Marathon will be Bungie’s first new title since the company introduced Destiny 2 back in 2017. Before the delay, the studio had also drawn raised eyebrows with Marathon after the alpha build used stolen artwork, which has been a repeat issue for Bungie.

This article originally appeared on Engadget at https://www.engadget.com/bungie-will-conduct-technical-testing-on-marathon-later-this-month-213422857.html?src=rss