ALL REPORTS
229 published reports, newest first.
229
Reportedly, Can seafloor spreading begin cold?
Seafloor spreading is generally thought to be aided by heat from magma rising from deep underground, which weakens the crust. But a research team reports that surveys in the southern Okinawa Trough point to a different possibility: broad normal faults may shape rift-like seafloor terrain and allow spreading to proceed even where regional heat flow is low and evidence for widespread magma supply is limited. The reported observations come from the Yaeyama and Yonaguni submarine grabens. Local magma activity remains possible, according to the report, but the proposed mechanism does not require broadly hot conditions.
- Public record
- 21 Oct 2026
- Location
- Unknown
Certificate authority’s private keys reportedly reduced to 256 guesses
Certificate authority eMudhra revoked eight intermediate certificates after researchers found that their P-384 private keys could be recovered by trying only 256 possible values. One published example reportedly had a private-key value of 4. The reported mismatch is that keys intended to help establish trust for website connections were allegedly weak enough to guess almost immediately. EMudhra reportedly attributed this to a certificate-generation script error: a second, weak set of keys was created and then selected because its labels resembled those of the proper keys. Mozilla, Google, and Apple added blocks or protections, while eMudhra said most affected intermediates were not used in production and it found no evidence that they issued end-user certificates. It also says there is no evidence the weak keys were abused.
- Public record
- 21 Oct 2026
- Location
- Unknown
Some ISPs reportedly send each DNS request to three resolvers
ICANN has identified ISPs that send each customer DNS request to three separate resolvers rather than relying on one. The reported setup sends requests to Google, Cloudflare, and another resolver; for non-cached requests, about half are reportedly repeated within 100 milliseconds, with another 30 percent repeated within 30 seconds. The unusual part is that the apparent effort to make DNS more reliable may instead create extra, unnecessary traffic. ICANN’s technologist said it is unclear whether this is a bug or intentional behavior, and the organization is researching the cause.
- Public record
- 21 Oct 2026
- Location
- Unknown
A certificate authority private key was reportedly just “4”
EMudhra, an Indian certificate authority, had private keys associated with eight intermediate certificates compromised. Security researcher Scott Helme reportedly found that one of the keys was simply the number “4”; others were reported as similarly small numbers. The strange part is the gap between a private key’s intended secrecy and a value that could be recovered from public certificates in less than a second. Such weak keys could let attackers create fraudulent HTTPS certificates for domains they do not control. It also says browser makers, Apple, and eMudhra took steps to stop relying on or revoke the affected certificates, while some other services may need to check their own environments.
- Public record
- 21 Oct 2026
- Location
- Unknown
Eight Internet-trusted certificate keys reportedly had only 3–8 bits of entropy
Eight intermediate TLS certificates associated with eMudhra Limited had private keys with only 3 to 8 bits of entropy. Because intermediate certificates can sign credentials trusted by browsers and apps, control of those keys could enable unauthorized certificates for any Internet site. The oddity is the reported key size: the article contrasts it with roughly 384 bits of entropy for a normal NIST P-384 private key. A digitally signed message was presented as proof that one affected key was controlled, prompting browsers and some other software to block the certificates, according to the report. It also says no malicious use had appeared in certificate-transparency logs at the time of publication, while older systems and embedded devices could take longer to update.
- Public record
- 21 Oct 2026
- Location
- Unknown
Meta Muse share links reportedly discoverable through conversation titles in DNS
Security researchers report that Meta Muse’s conversation-sharing links could be found by people who were never given them. The reported issue is not simply that a link was public: the conversation title was allegedly placed in the link’s subdomain, where passive DNS records could make it searchable. The researchers enumerated 6,800 share links and found examples containing personal and business information after opening some of them. Meta reportedly paused the sharing function while it reviews the report and considers changes to how the links can be discovered. The strange reversal is that a sharing link meant to be hard to guess may have advertised its own subject in a public DNS trail.
- Public record
- 21 Oct 2026
- Location
- Unknown
Official Rank Math PRO downloads reportedly carried website backdoors
Some downloads of Rank Math PRO, a WordPress SEO plugin, were reportedly distributed with malware through the vendor’s official website during a limited window. According to the vendor, activating version 3.0.123 could compromise the website it was installed on. The alleged infection came with a plugin obtained from its own supplier rather than from an obviously untrusted download. The vendor says the malware could leave hidden, persistent access and recreate backdoors when an infected site was visited; it also says simply deactivating or updating the plugin would not remove an existing compromise. A clean version, 3.0.124, was reportedly released. The free Rank Math SEO plugin was reportedly not affected.
- Public record
- 20 Oct 2026
- Location
- Unknown
Rare hybrid crabs reportedly surged in the Bering Sea
Trawl surveys in the eastern Bering Sea found an unusual surge of snow crab–Tanner crab hybrids in 2025. These hybrids had historically been rare, but were reported to be 13.4 times more abundant than the historical average and to make up nearly half of commercially sized male snow crabs available to catch. The oddity is that the increase followed a collapse in the snow crab population after the 2018–2019 marine heatwave. Computer modeling described in the report points to reduced sea ice and the snow crab collapse, with less competition and predation, as a likely route for hybrids to become more abundant.
- Public record
- 20 Oct 2026
- Location
- Unknown
Malformed IPv4 packets reportedly let a KVM guest reach its host
A Linux KVM virtual machine could potentially reach its host by sending malformed IPv4 packets. The reported flaw, dubbed PwnEscape and listed as CVE-2026-99999, is described as involving checksum metadata that can alter packet information after earlier checks have occurred. That would undermine the separation virtualization is meant to provide: guest machines share a physical server but are supposed to remain unable to inspect or control the host. The possible consequences include host code execution, a crash, or disclosure of sensitive memory. An upstream Linux kernel fix is reportedly making its way into major distributions.
- Public record
- 19 Oct 2026
- Location
- Unknown
More than $600 million reportedly traded in election markets after races were effectively over
More than $600 million in contracts tied to Ethiopian and Romanian elections traded on Polymarket after the underlying races had effectively been settled or replaced. In the Ethiopian market, the platform’s resolution rules reportedly left trading open for 123 days after the election. The strange part was not merely that the markets remained open: much of the reported volume was in losing candidates, and an analysis described repeated rapid trades between pairs of accounts. Researchers quoted in the report said the patterns could indicate wash trading or attempts to inflate activity, but also cautioned that trader identities are unknown and suspicious-looking trades are not necessarily wash trading.
- Public record
- 17 Oct 2026
- Location
- Unknown
Ubuntu 26.10 reportedly shipped with a kernel still in release-candidate testing—then planned to update it once the finished version arrived
Ubuntu 26.10 was released with Linux kernel 7.3 while that kernel was still at release-candidate 7 rather than officially complete. The reported plan is for installed machines to receive the finished 7.3 version once it becomes available. That creates the odd mismatch: a finished operating-system release reportedly arrived carrying a kernel that was itself still pre-release. The same report says Ubuntu’s new Myna speech-to-text feature is included as a technology preview; it reportedly improved with a USB headset but entered spoken punctuation and editing commands as ordinary text.
- Public record
- 17 Oct 2026
- Location
- Unknown
One LLM Reportedly Gave Different Answers on Different Devices
An article reports that the same Qwen2.5-1.5B-Instruct model file, given identical token IDs and decoded greedily, produced different written answers on an Apple M1 MacBook and an NVIDIA Jetson Orin Nano Super. In the reported 250-problem GSM8K math subset, 38 generated responses differed and 18 final answers differed, despite fp16 results whose overall scores were close. The article attributes the split to tiny, deterministic floating-point differences between hardware and software kernels. It says a near-tie between candidate tokens can send a generated solution down a different path. Its int8 Jetson setup reportedly changed still more answers, but that setup also changed both weight precision and runtime, so it did not isolate which change caused its larger score drop. The tests cover one model, one device pair and fixed benchmark subsets.
- Public record
- 16 Oct 2026
- Location
- Unknown
A Community Is Reportedly Closing After AI Made Game Decompilation Easier
A website called decomp. Dev is reportedly shutting down after AI made a task central to its community far easier. The site hosted tools and file libraries for reverse-engineering and recreating video-game code, work its administrator said had historically taken years of collaboration. The pseudonymous administrator, Encounter, said newer AI models can speed up decompilation with guidance, human input, and code review. They said this made it difficult to distinguish human-led projects from AI-led ones, while AI-assisted “hostile forks” could race ahead with basic, partly functional ports. The odd reversal is that decomp. Dev was designed to make slow human progress motivating: members could watch tiny percentages of a decompilation advance. Encounter reportedly said AI has instead turned that measure into a hollow numbers game, prompting the community site to close.
- Public record
- 16 Oct 2026
- Location
- Unknown
Accenture reportedly caps central Claude funding at $29 a month
Accenture reportedly changed how it funds Claude Enterprise usage, centrally covering only $29 per person per month from October 1. Employees who exceed that amount must find a project or team budget to pay for the rest. That is a sharp mismatch for some reported users: internal messages described monthly Claude use above $500 and, in one case, around $500 to $1,000. One employee was also reported to have lost Claude access altogether. The unusual part is the reversal: a company that has promoted AI investment to clients is reportedly placing a tight central limit on its own employees’ AI spending. Accenture said it aims to provide the right tool for the right work and continues to invest in AI capabilities, skills, and enablement.
- Public record
- 16 Oct 2026
- Location
- Unknown
Reportedly, Reports say a rock was unusually warm at 45 km deep—then recorded cooler-than-expected conditions farther down
A report describes a rock from Goodenough Island in eastern Papua New Guinea whose minerals indicate it was carried into a subduction zone more than 90 kilometers deep around 4.4 million years ago. The rock recorded roughly 700 °C at about 45 kilometers depth, then only about 100 °C more after descending beyond 90 kilometers. The reported pattern is unusual because the shallower stage was warmer than expected, while the deeper stage was cooler than expected by current subduction-zone models. The researchers cited in the report suggest extra heat from intense shearing at shallow depth, or a young subduction system that had not yet cooled, as possible explanations.
- Public record
- 16 Oct 2026
- Location
- Unknown
A near-infrared signal reportedly appeared twice in a patch of sky where earlier observations showed no source
A report describes an unusual near-infrared signal in a small part of the Hubble Ultra Deep Field. It reportedly appeared in two JWST observing windows 88 days apart, at different observing angles, but earlier Hubble and JWST observations showed no visible source at that position. The reported signal was a single bright emission line near 1.6 micrometers. That is the mismatch: the line was reportedly bright enough that it should have appeared in an earlier JWST survey if it had been present then, yet there were no accompanying lines to identify its distance or origin. The researchers reportedly considered an early or more recent galaxy, a supernova, and a black hole disrupting a star, but none cleanly explains all the observations. They call for deeper spectroscopy to find further lines and determine what produced it.
- Public record
- 16 Oct 2026
- Location
- Unknown
Plastic particles in water may not be chemically inert after all
A reported laboratory study suggests that plastic particles in water may generate highly reactive oxygen-containing molecules at their surfaces—an unexpected result for a material commonly treated as chemically inert. The researchers tested six plastics in water and reported radical production from each, with stronger signals from more water-repellent plastics. They also reported that the effect weakened when a surfactant altered the particles’ surface-water interface. Their proposed explanation is that water molecules next to water-repellent plastic are arranged differently and that the plastic surface’s electric charge helps make radical formation easier. The team further reported protein clumping and damage to mouse red blood cells in experiments involving plastic particles, but said the implications for human exposure and disease remain unresolved. The particles were largely fresh laboratory powders, and the researchers said particle age, size, real-world exposure, and the size of any human effect still need study.
- Public record
- 16 Oct 2026
- Location
- Unknown
AI Rust port reportedly copied bugs from the code it translated
A developer reportedly used AI agents and about $24,000 in API-equivalent tokens to port Microsoft’s TypeScript compiler to Rust. The reported result passed the TypeScript conformance tests with nearly 100 percent accuracy and was claimed to run twice as fast as Microsoft’s Go-based rewrite. The stranger part is how the agents reportedly got there: rather than translating the original JavaScript implementation directly, they appear to have used the Go rewrite as their starting point. That shortcut also carried a few bugs from the Go version into the Rust port—something the developer said he learned only after another person pointed it out.
- Public record
- 16 Oct 2026
- Location
- Unknown
Reportedly, Reports say supermarket refrigeration controllers were turned into heaters
Unknown attackers compromised refrigeration controllers at nearly 700 French supermarkets, reportedly raising the heat to 122°F (50°C). This spoiled food and sparked fires. Security researchers had reportedly warned in August that flaws in the affected controllers could allow attackers to “freeze the controller” or “defrost the food.” The devices included internet-accessible systems, some of which were no longer receiving updates or were running outdated firmware.
- Public record
- 16 Oct 2026
- Location
- Unknown
Reportedly, Reports say a custom driver made an e-paper screen show four gray levels at 30 fps—by stopping pixel transitions partway through
YouTuber Bo Made It built an “InkBoy” that runs emulated Game Boy games at 30 frames per second on a 1.54-inch ESP32-S3 e-paper board, showing four shades of gray. The unusual part is that the screen was described as having a refresh time of about 300 milliseconds and as being intended mainly for static images. The reported workaround was a custom driver that stops pigment transitions partway through and drives pixels individually, rather than using the display’s original driver. The report also says the code was released on GitHub, with a warning that custom waveforms and faster refresh rates could permanently damage e-paper panels and that long-term panel life was not tested.
- Public record
- 16 Oct 2026
- Location
- Unknown