Instagram is testing a new longform, horizontal video format called "Features" as it pushes further into YouTube territory and expands its presence on TVs. The Verge reports: Instagram boss Adam Mosseri has been against doing longform video on the platform "for a long time," he says in a six-and-a-half-minute video (here's the widescreen version) with VP of product Tessa Lyons, saying that "one of my concerns has been, how do we make sure that we keep Instagram not just about entertainment, but about connecting with friends." If you watch a longform video, "it's a lot of Reels, photos, and carousels that you might not have sent to a friend," meaning less likes and shares. Now, though, the team is working on making shortform and longform video "symbiotic," according to Mosseri, like podcasts or comedy specials that can be both long videos and broken up into shorter ones.

The announcement of this widescreen video push also follows the launch of Instagram's TV app late last year. That app launched first as a Reels-focused experience and as a pilot for Amazon Fire TV devices in the US, but it's since expanded to Google TVs, Samsung TVs and Apple TV, and Instagram launched new features like the ability to watch Stories earlier this year.

Highway thieves have stolen more than $100 million in data center equipment since June, employing increasingly sophisticated tactics such as forging driver IDs and spoofing GPS tracking systems. NBC News (paywalled) reports that thieves have "made away with more than $100 million in data center freight." Ars Technica reports: Here's how they said thieves get away with it: First, thieves hack freight brokers' accounts on shipment-listing websites and post fake shipments to lure real bids, then send a malicious link to any trucking companies that respond. Once victims click, thieves install software to take control of their accounts and start bidding on real shipments. Sometimes, a real delivery driver is hired to collect the cargo, unaware of the scam, and other times fake driver's licenses are used to get accomplices hired. Either way, the goods are eventually transferred to a driver working with the thieves to resell the gear, and, in one of the largest thefts, tracking coordinates were spoofed to prevent digital monitoring. Equipment commonly targeted includes "servers, fiber-optic cables, computer memory chips, copper wires, and bitcoin mining machines," NBC News reported.

Some trailers hit seem to be carrying only data center equipment, like two stolen freights found in Illinois. The Cook County Sheriff's Office estimated those contained $300,000 worth of copper wire spools and about $1 million in "custom-made data center modular power solutions equipment," NBC News reported. Other trucks impacted were carrying additional freight, like a Los Angeles County Sheriff's Department case where "data center cooling equipment" bound for Deepcool AI was recovered among nicotine pouches, televisions, shoes, printers, speakers, and skin care cosmetics. Experts worry that means Americans may be broadly harmed by the thefts, not just the AI industry.

While some stolen goods have been recovered, in two of the largest thefts that NBC News found, none of the equipment was found, and off-duty cops hired to escort the shipments were targeted in hit-and-runs. [...] Broadly, cargo thieves are infiltrating email accounts to find lucrative shipments, misdirecting shipments, disrupting GPS tracking, and using AI to create fake driver's licenses to get accomplices hired as delivery drivers. LASD's Sgt. David Pantoja told NBC News "that's how most of it is being done," which is a big shift from the past when highway thefts were largely opportunistic.

Apple has unveiled a redesigned iPad Mini with a larger 8.5-inch OLED display, an A20 Pro chip, twice the peak brightness and slimmer bezels while maintaining roughly the same footprint. It starts at $699 ($200 more than its predecessor) and will be available November 6. The Verge reports: Despite having a slightly bigger display than the 8.3-inch screen on its predecessor, Apple says the device maintains the same small footprint thanks to bezels that are 24 percent slimmer. The iPad Mini is 5.4mm thick as well, making it thinner and lighter than the previous generation, according to Apple. It also comes with an IP67 rating for protection against water and dust.

Aside from an OLED display, the new iPad Mini features an upgraded A20 Pro chip. This enables support for some of Apple's new Siri AI features, including the ability to tweak the expressiveness and pace of the assistant's voice. Apple says the upgraded iPad Mini also comes with two times the peak brightness than the previous generation. iPad Mini's 12MP front-facing camera is now on the long edge of the device, making it easier for video calls in landscape orientation.

An anonymous reader quotes a report from The Seattle Times: Microsoft is offering buyouts to about 60,000 employees, or roughly a quarter of its workforce, as the company tries to control its head count while avoiding layoffs. The Redmond-based tech giant announced Monday morning that eligible employees at the vice president level and below in the U.S., Canada, India and the United Kingdom would receive a "voluntary exit offer" of a standard severance package, based on their location.

In a memo to employees, Microsoft Chief People Officer Amy Coleman said the move was building off the voluntary retirement program earlier this year, which was available to more than 8,700 U.S.-based employees, roughly one-third of whom took the offer. Since May 2025, Microsoft has been trying to reduce its corporate workforce, first through waves of mass layoffs and now through more creative buyout programs. The company laid off about 15,000 employees last year over the course of several months, affecting about 3,200 Washington-based workers. The report notes that the layoffs have continued this year, though on a smaller scale and largely concentrated in the company's gaming division.

"Despite massive investments and widespread hype around AI , the technology has delivered zero financial payoff to corporate America outside of tech," writes the chief economist at U.S. asset management firm Apollo Global.

He adds that "there are still no signs of AI boosting productivity growth... [M]ainstream corporate America is pulling back and starting to view token spending not as a source of growth but as a cost center that weighs on margins." VC-backed companies are spending more and more on tokens, but mainstream corporate America does not need the latest model and is unwilling to pay for it. As long as agentic AI and token spending are confined to a small part of the economy, the macroeconomic effects of AI will be very limited...

The question looking ahead is whether, even as models become commoditized, mainstream corporate America can turn increasingly cheap intelligence into higher revenue growth and higher profit margins. That may be harder than it sounds. AI may be a great calculator, but in business, intelligence is mostly judgment. Judgment depends on context, and the answer varies with which human or which model you ask. Perhaps most importantly, AI does not understand accountability, trust, culture, unwritten rules, ethical trade-offs or fairness, all of which shape reputational risk and ultimately drive revenue growth and profit margins.

The bottom line is that the AI story will be decided in the S&P 493, not the Mag 7, and so far, there is no evidence that revenue growth or margins are improving outside the tech sector.
More details from TechCrunch: Apollo's Torsten Slok focuses on what he calls the S&P 493 — the S&P 500, minus Alphabet, Amazon, Apple, Meta, Microsoft, Nvidia and Tesla — finding that profit margins and revenue per worker appear to be flat, with no evidence that AI is improving productivity...

Recent studies have also found that AI has yet to deliver significant productivity gains.

The Free Software Foundation's "EncryptFest" today covers both encryption and privacy. The free two-hour event runs from 13:00-15:00 Eastern Daylight Time (17:00-19:00 UTC), and includes:

— A discussion on "bulk surveillance, and how encryption protects personal privacy"

— A short video from renowned cryptographer Bruce Schneier.

— A discussion with Henry Fisher, the founder of Techlore and a digital rights activist

— A hands-on workshop on how you can encrypt your email using the FSF's Email Self-Defense guide "as a concrete step to enhance your data privacy"

You may join us virtually, or if you are in Boston, Massachusetts, United States (the FSF's home base), you can join us in-person at the Boston Public Library's Copley Square branch. You may also join us in-person at MakeHaven in New Haven, Connecticut, US, and meet our deputy director Sean O'Brien. Whether attending our event online or in-person, please register. It will help us plan ahead and enable us to contact you about other important details before the workshop, like what to expect and what to bring...

Bulk surveillance violates our fundamental rights and makes free speech dangerous. Email encryption is an excellent tool you can use to shield yourself from bulk surveillance. Encrypting your email is also a concrete step towards protecting your data from others whose intentions may not be honorable.

America's Defense Department "has spent months quietly building an elite new tech agency," reports Politico, "to help covertly disrupt and sabotage foreign technology programs considered threats to American military superiority." Information on the Technology Support Office, or TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda. While the specifics of its work are highly classified, POLITICO spoke with 12 current and former U.S. national security officials with varying degrees of knowledge about TSO to understand how the agency came to be, the broad contours of its mission and why its operations are shrouded in secrecy...

[The Pentagon's Defense Secretary and Deputy Defense Secretary] established TSO quickly and without attracting outside scrutiny because they largely built the agency by reorganizing two classified Pentagon intelligence programs that have conducted similar clandestine tech-sabotage efforts at a smaller scale since 2023. But by creating an agency dedicated to expanding that work, the Defense Department is signaling its intent to ramp up a range of aggressive covert activities abroad — potentially including cyberattacks, supply chain disruptions and disinformation operations. Many of the people who spoke to POLITICO argued that the aggressive new initiative is needed to help the Pentagon counter foreign adversaries they say are harnessing artificial intelligence and advanced commercial technologies, such as drones, in creative ways that could erode America's military advantage...

While TSO lacks the legal authority to conduct clandestine operations directly, it works closely with senior U.S. military and intelligence officers to develop cutting-edge tools and strategies to disrupt adversaries' access to critical defense technologies — or subvert them from afar. TSO is staffed with engineers, special operators and intelligence officers, and its work spans everything from building bespoke hacking tools to planning elaborate deception operations that trick adversaries into installing faulty components — likely designed by TSO — in key foreign weapons platforms. TSO's overarching goal is to "buy time or stop adversaries from developing technologies" that would most threaten the U.S. military in a major conflict, said a former U.S. intelligence official who worked closely with the agency... A second former Pentagon official and a former U.S. national security official said the agency has told some defense contractors it's interested in offensive hacking capabilities. The former senior Pentagon intelligence official estimated that its budget for classified contracts alone is likely north of $1.5 billion.

They are seeking contractors on "the leading edge of technology," that official said, and hope to procure "a whole host of tools wherever your imagination can go."
Pentagon staff had been exploring the need for a new agency for over a year, the article explains. Creating a new agency with its own budget and procurement powers "would empower the agency to more quickly integrate cutting-edge tech from the private sector," Pentagon staff concluded, "and think more strategically about which foreign defense technologies pose the biggest threats across U.S. military organizations."

"Several people who spoke to POLITICO support TSO's mission but worry that the secrecy surrounding its work could embolden current Pentagon leadership to carry out missions that flout international law or funnel coveted classified contracts to political allies."

Thanks to long-time Slashdot reader schwit1 for sharing the news.

Cloudflare reported millions of attempts to exploit two serious PHP flaws this week. The PHP foundation has "no evidence hackers were able to exploit the vulnerabilities before they were disclosed," reports Reuters, but the incident still shows how critical the three-decade-old programming language is.

"Yet the nonprofit foundation that supports PHP, which may underpin up to 70% of sites globally, operates on a shoestring budget." "We have one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches... "We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems," she said...

Recent events have shown how heavily companies and governments rely on PHP, Barron said. "Given that reliance, it is clear that PHP is incredibly under-funded."
AI helps researchers find decade-old flaws, but "it is also increasing maintainers' workloads," the article points out. "The PHP project is receiving nearly twice as many proposed code changes as a year ago." But unfortunately, the foundation's executive director says "the number of contributors hasn't doubled," and reviewing contributions and bug reports requires "a massive amount of human input and experience."

Wednesday the foundation said they hope to increase the number of knowledgeable engineers, but also "give the security team the resources it needs. We can only achieve this goal with funding from those who depend on PHP."

Their blog post also acknowledged the first signs of the bug were discovered in 2024, but that work on a fix stalled and restarted repeatedly over months (when there was still no known path to remote code execution): We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged...

The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media... In response, the PHP project brought its pre-announcement forward [and also the release date for the patch. But as a result of the leak and pre-announcement] one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various exploitation proofs of concept, which then increased circulation on October 21st. Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing proofs of concept after the leak but did not identify any functional exploits at the time of release/public disclosure.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
But the PHP Foundation also said Wednesday's patch "shows the progress we're making in how PHP security is handled." Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly... We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.
Thanks to Slashdot reader Mirnotoriety for sharing the news.

Writing contests face "a literary version of the ruined world" in Blade Runner, writes CNN. "Anxiety and suspicion about robot infiltrators are everywhere — and so are people claiming to hunt the robots down." Multiple companies now offer products that promise to spot the difference, with often contradictory, biased or erratic results. The makers of Pangram, an AI detection platform that has been cited as authoritative in many of the recent controversies, claim it can distinguish between human and synthetic writing with near-perfect accuracy... The company's own estimates claim that false positives — in which the tool wrongly reports that a piece of human writing was created — are 1 in 10,000 and shrinking. Peer-reviewed studies from the University of Chicago and the University of Brussels support that claim, though one 2025 study from the University of Maryland found that Pangram erroneously labeled 2% of documents as AI.

A widely referenced 2023 Stanford study that found AI writing detectors produced higher rates of false positives on writing from non-native English speakers was conducted before Pangram was created. Pangram ran an internal study using a database of non-native English texts and self-reported that false positive rate was around 8 in 10,000... Given the thousands upon thousands of pieces of writing published each day, a 1 in 10,000 chance of a false accusation — let alone an 8 in 10,000 chance — means that even the most trusted AI detector is going to be wrong, and wrong about a lot of people.

Pangram isn't able to tell users the truth about someone's writing, but it is able to introduce something much more complicated: doubt. Unless an accused writer confesses to using an LLM, there is no bulletproof way to prove an accusation, short of being given full access to someone's computer history and finding the chatbot prompts... To some people and institutions on the literary side, using automated AI writing detectors to fight the influx of AI writing is just trading one form of technological domination for another.
Pangram "has entered the public consciousness at a time of distrust that goes beyond writing," CNN notes, when people want to block "at least some of the daily overflow of misinformation and misrepresentation" recently studied by John Warner, the author of More Than Words: How to Think About Writing in the Age of AI .

But he's one of the people who believes AI-detecting tools can create a new dependence on another kind of machine. "Like all other technology of automation, that is going to de-skill people from discerning these things for themselves."

NASA is accelerating its Artemis program with an Apollo-era sense of urgency, aiming to return astronauts to the lunar surface in 2028 and establish a permanent base near the moon's south pole. The Associated Press reports: Administrator Jared Isaacman said Friday that the space agency is still on track to launch Artemis III next summer on a docking exercise with Elon Musk's and Jeff Bezos' lunar landers. The two-week mission featuring four astronauts will be confined to orbit around Earth -- no moon trip this time. The all-important Artemis IV -- NASA's first moon landing by astronauts since Apollo -- remains scheduled for 2028, Isaacman said. His update came six months after the successful Artemis II flight around the moon by four astronauts, humanity's first lunar trip in more than half a century.

NASA will keep its options open as long as possible before choosing between SpaceX and Blue Origin for the Artemis IV lunar lander, according to officials. Isaacman said the "new space race" to land astronauts on the moon -- racing against China now versus the Soviet Union during the Apollo era -- will be "much closer than it ever needed to be" because of slow going in past years. But the space agency is now accelerating its pace, he noted, eliminating endless meetings and bureaucratic inertia, as SpaceX, Blue Origin and other companies scramble around the clock to meet the deadlines and NASA bolsters its workforce.

Adopting Apollo's urgent and intense approach from 1968 through 1972, a period which saw 24 astronauts fly to the moon and 12 land on it, is not "tech industry pixie dust or some new management philosophy," Isaacman said. "It's about our own history. It's a playbook this agency knows really well, the same playbook that went from Apollo 7 splashdown to Apollo 11 in just nine months," he said during a news conference at Kennedy Space Center.

Frustrated by intrusive ads, sluggish interfaces, and data tracking, smart TV owners are using AI coding tools and open-source projects to strip unwanted software from their televisions and build customized home screens. The Verge reports: Several vibe-coded TV-debloating projects exploded in popularity over the weekend. Cleanyourtv (known as tv-vibehack until the 19th), tv-detox, and dumbtv all claim to accomplish similar things -- remove sponsored ads, debloat the TV so it runs faster, and block unwanted data collection that tracks what you're watching -- without hacking, or rooting, the TV. By default, they all also replace the TV's built-in app launcher with simpler ones. Many users are going a step further and vibe-coding their own replacement launchers, like the Pokemon one below.

Most of the projects we've seen so far focus on TVs that run on Android and Google TV operating systems (such as TCL, Hisense, Sony, and older Amazon Fire products), using existing developer modes and the Android Debug Bridge (ADB) to tweak settings and apply (and remove) packages. According to the GitHub pages, they can also work with some Fire TV products that use a custom fork of Android (although likely not on the new Vega-based Fire TV Sticks). Because they use built-in developer tools, they don't require root access or firmware hacking, and they're reversible. Even projects that totally change the look of the interface just use Android's ability to install custom launchers -- in many cases with an assist from Claude Code or a similar tool to create the new launcher, too.

The New York Knicks reportedly sent employees a fake offer of complimentary NBA championship rings as part of an internal phishing test, requiring anyone who clicked the link to attend mandatory cybersecurity training. "Congratulations, your Employee Championship Ring is here," the email said. According to The New York Times, Madison Square Garden employees who clicked that link "were forced to attend a mandatory cybersecurity class to help satisfy some of [owner James] Dolan's growing cybersecurity concerns." Ars Technica reports: The offer wasn't implausible, either. "Typically, most employees for NBA teams receive rings, even if they are not as fancy and expensive as the ones the players receive," wrote Joe Vardon, senior NBA writer for The Athletic, which was bought by The New York Times in 2022 and then merged into the parent news organization. Vardon's article was primarily about how Knicks assistant coaches did not get rings on Tuesday when the team raised its first league championship banner since 1973. The assistant coaches were handed boxes without rings inside, though they are expected to receive rings later on.

"Ring orders, designs, and measurements can take time, and not every coaching staff for every defending champion gets its rings on ring night... The Knicks assistants were told they would receive championship rings eventually, but many longtime employees at Madison Square Garden, including some who work in the Knicks' business operations, will not receive rings at all, team sources told The Athletic," Vardon wrote. MSG employee hopes were raised "at the end of September when the Knicks sent an email to a long list of employees, which gave recipients a first glimpse at their would-be championship rings," Vardon wrote. The email included "a graphic of two differently styled rings" that the lucky employees could supposedly choose from, the article said.

"(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you," the email said. "There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below." Vardon wrote that "multiple team sources" confirmed the email was a phishing test. It's not clear how many employees clicked the link or whether any of the employees who received the email will eventually get some type of championship ring. We contacted the Madison Square Garden Sports organization with these questions and will update this article if we get a response.

An anonymous reader quotes a report from Ars Technica: Comcast reportedly plans significant job cuts in its cable division as the firm continues to lose residential broadband and TV customers. Comcast lost 144,000 residential broadband customers in Q3 2026, up from a 91,000-customer loss in the same quarter a year ago, the company said in its earnings report today. Comcast historically capitalized on a lack of competition for high-speed wired broadband. But now it faces stronger competition from fixed wireless providers and from fiber providers in parts of its cable territory. "Fixed wireless remains aggressive and continues to take share, while fiber construction remains elevated, with pockets of irrational pricing and promotional activity," Comcast co-CEO Mike Cavanagh said today in an earnings call.

Comcast CFO Jason Armstrong said "irrational pricing" from fiber operators includes $30 to $40 monthly broadband offers "in specific markets in the third quarter." He said $30 to $40 pricing is irrational because deploying fiber costs $1,500 or more per home, and is "getting more expensive with construction costs up as you get into more suburban and rural areas." "As we look at the return profile of that, to us, that is irrational competition," Armstrong said. While he didn't name any specific competitors, Verizon has been pitching FiOS fiber plans that start at $30 a month. Comcast's network is a mix of fiber and cable, and it offers fiber-to-the-home in only small portions of its cable territory.

Armstrong said more Comcast customers are leaving when they face "pricing transitions," apparently referring to the price hikes customers get when promotional offers expire. "We've been refining our offers and retention strategies to better manage these transitions and strengthen customer retention," he said. Cavanagh said that "satellite is not yet a material factor" in the competition Comcast faces, but that Comcast is focused on "anticipating emerging forms of competition and positioning our business to respond as the market evolves."

Google is funding one of the nation's largest "virtual power plants," paying homes and businesses indirectly to reduce electricity consumption during periods of peak demand so more grid capacity can be available for data centers. Under its expanded deal with Voltus, the program could provide up to 1,070 megawatts in the Mid-Atlantic PJM grid -- roughly the output of a large nuclear reactor. The New York Times reports: That electricity won't come from new power plants. Instead, Voltus will sign up homes and businesses and give them financial incentives to curb their usage when local power demand is high or the grid is strained. Many of these reductions could occur automatically, such as through smart thermostats that dial back air-conditioning during peak summer hours or batteries that can provide temporary on-site power.

Each of these tweaks frees up only a small amount of power on its own. But by aggregating them across thousands of businesses and homes, Voltus says it can reliably provide lots of extra capacity when it's most needed, and do so within a few years. While tech companies will likely ultimately need to build traditional power plants if they want to keep building large data centers, this approach could be a faster, cheaper and less-polluting option in the interim. "We really see virtual power plants as a critical short-term solution," said Ellen Zuckerman, head of energy market development for North and South America at Google. "It's a way to invest in our communities, really double down on our clean energy ambition, but also meet capacity at speed and scale."

BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, "The PHP story feels like the cyber equivalent of an unexploded bomb -- I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet." Although no successful attacks have been confirmed, the AI-assisted discovery of long-hidden flaws has triggered a worldwide security scramble, with websites taken offline as a precaution and administrators racing to deploy patches before attackers can exploit the vulnerabilities. From the report: The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. [...] It was supposed to be kept quiet until everyone had a chance to fix their sites -- but the news was leaked. From that point the clock started ticking.

As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. "There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out."

But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success. "We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," Gina Neff, Professor of Responsible AI at Queen Mary University, told the Today Program on BBC Radio 4. "We have enormous capability to handle these risks."