Technology & Science

Filings with the Texas Attorney General indicate that about 19.9 million people had personal and medical data compromised in a cyberattack on Oracle Health's older Cerner systems, according to a report published Monday. That is far larger than earlier patient notices suggested. The state's breach portal posted Cerner's entry on Oct. 2 and lists 2,992,244 affected Texas residents. The intrusion dates to early 2025. Exposed data may include Social Security numbers, diagnoses and medical images. BleepingComputer previously reported that an extortionist calling himself 'Andrew' contacted affected hospitals, demanded cryptocurrency, and threatened to leak or sell the records. Oracle's own account of the national total was not part of the report, and the nationwide figure rests on the filings as relayed by the outlet.

ATLANTA — Southern Company is notifying about 400,000 customers that an unauthorized party reached their account information through its online customer portal. About 300,000 are Georgia Power customers and roughly 100,000 are Alabama Power customers, around 6 percent of that utility's base. Mississippi Power is named in the notice without a figure. Exposed fields include names, mailing addresses, phone numbers, emails and the last four digits of Social Security numbers, plus basic account details. Bank account, payment card and driver's license numbers were not included, the company says. Southern says it detected suspicious activity, acted to stop it, notified law enforcement and has found no sign of continuing access. It has not said when the intrusion occurred or how the attacker got in. Customers are being offered one year of credit monitoring, and analysts note the data is enough to make phishing lures convincing.

WASHINGTON — The Cybersecurity and Infrastructure Security Agency is pointing agencies to Binding Operational Directive 26-04 in its latest vulnerability alerts. The directive tells federal civilian agencies to fix, quickly, flaws in its Known Exploited Vulnerabilities catalog that sit on publicly exposed assets and give an attacker total control once exploited. Lower-risk items can be deferred. It also sets baseline expectations for when agencies must check whether attackers got in before a patch was applied. On Oct. 15 CISA added an Atlassian flaw, CVE-2026-21589, to the catalog, and its Oct. 16 BeyondTrust alert directs readers to the same guidance. The directive binds only federal civilian agencies, but CISA encourages all organizations to adopt risk-based prioritization. The agency says it will keep adding vulnerabilities that meet its criteria.

WASHINGTON — The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from their IT systems and to stop buying them. The notice is due in the Federal Register today. It rests on the Federal Acquisition Supply Chain Security Act of 2018 and a review by the Federal Acquisition Security Council. It covers Hangzhou DeepSeek Artificial Intelligence and its affiliates. It also covers third-party products and services developed using DeepSeek implementations, which would likely include tools built on its open-weight models. Secretary Markwayne Mullin cited data-transfer and malware risks. A copy of his letter in the notice is dated June 26, so the ban has been in place for months. Agencies can seek exceptions within 60 days, with CISA deciding each request. DeepSeek has 60 days after notice to challenge the order in the D.C. Circuit. The order does not reach private companies or consumers.

SAN JOSE — U.S. District Judge Edward Davila said at an Oct. 14 hearing that he is highly likely to grant Apple a preliminary injunction against OpenAI, its io Products unit and two former Apple employees. He has not yet ruled. Apple sued July 10 in the Northern District of California (5:26-cv-07078). It alleges a coordinated effort to take confidential hardware designs and manufacturing knowledge. The individual defendants are engineer Chang Liu and Tang Tan, now OpenAI's chief hardware officer. One day before the hearing, the judge granted part of Apple's request for expedited discovery. That order requires forensic images and communication records and allows early depositions of four people, including Liu and Tan. OpenAI has called the accusations groundless and retaliatory. An injunction could force OpenAI to show its devices do not rely on the disputed material. Reports say it is aiming for a speaker in 2027.

SANTA CLARA, Calif. — Nvidia has released new open-weight models for always-on agents. Nemotron 3.5 Super VL has 120 billion parameters and targets enterprise agents. Nvidia says it matches the larger Nemotron 3 Ultra on instruction-following and tool use. The company also says it finishes tasks faster than competing models from Anthropic and OpenAI, including Opus 5 and GPT 6.1 Sol, but only after post-training on specific agentic tasks. No independent test of that comparison has been reported. At the small end are two Bolt models. Nemotron 3.5 Bolt 74B-A9B 24GB is a 74-billion-parameter model meant for local agent work on PCs. Super VL and that Bolt model are available now. A smaller Bolt E4B is due later this month. Kari Briski, Nvidia's vice president of open models and software, said organizations can now run agents on Nvidia infrastructure without trading capability for deployability.

BOSTON — Medical AI companies OpenEvidence and Doximity have settled their federal lawsuit in the District of Massachusetts. They reached a settlement in principle Thursday, and all claims and counterclaims were dismissed with prejudice Friday. Each side bears its own costs and fees, and the joint notice gave no terms. OpenEvidence sued in June 2025. It alleged that Doximity staff posed as physicians, misused National Provider Identifier credentials and used prompt-injection prompts to extract its system instructions. It later dropped trade-secret claims and pursued computer-fraud, contract and unjust-enrichment claims. Doximity denied the allegations and countersued for defamation, false advertising and unfair business practices. In January, Judge Richard Stearns let both sides' main claims proceed. The case was in discovery, and OpenEvidence faced a deadline to produce communications after a dispute over deleted Slack and messaging history, when the parties settled.

Researchers reported in Nature Medicine, published online October 14, a phase 1 trial of personalized vaccines targeting each patient's own tumor mutations in platinum-sensitive ovarian cancer. The trial was small, with ten patients, and was designed to test feasibility and immune response, not to prove the vaccine works. Eight of the ten patients showed an interferon-gamma immune response to at least one vaccine peptide pool. Of 144 vaccine peptides, 85 (59%) provoked an immune response. Patients whose disease was held in check, either temporarily or for longer, responded to more of the targeted mutations than patients whose cancer progressed. The averages were 9.3 and 5.5 mutations respectively, with a P value of .029. More than 73% of target mutations were still detectable in blood DNA at the final booster, despite a median 6.5-month gap between biopsy and first vaccination. Larger trials would be needed to test clinical benefit.

Researchers at Penn State report evidence of two distinct magma reservoirs beneath Masaya, an active Nicaraguan volcano near Managua. About 2 million people live within roughly 13 miles of it. The study, published in Geophysical Research Letters, analyzed six years (2018 to 2024) of Sentinel-1 radar satellite data. The ground inside the caldera first sank and then rose, which the team interprets as fresh magma entering a deeper reservoir. The area around the active Santiago crater and its lava lake kept sinking throughout, which suggests a separate, shallower source behaving independently. The findings are inferences from ground deformation and a simplified model of the reservoirs, not direct imaging. The authors say no immediate hazard was identified, and that longer-term monitoring and modeling are needed to improve eruption forecasting.

PARIS — The European Space Agency announced Monday that its Euclid space telescope has found a comet no one had catalogued. It is the first new comet the galaxy-mapping observatory has discovered. The object is designated C/2026 S1 (Euclid). Helsinki doctoral student Mikko Pöntinen's moving-object software flagged a streak in images taken between Sept. 16 and 24. Follow-up showed a fuzzy coma of dust and gas, and the Minor Planet Center confirmed the comet on Oct. 8. It lies about 1.3 billion kilometers from Earth, between the orbits of Jupiter and Saturn. Its orbit arches steeply above the plane of the planets and takes thousands of years to complete. Euclid avoids the dusty plane of the solar system, which makes such finds unlikely. ESA says the comet is not a candidate target for its Comet Interceptor mission, but the alert process was a useful test of how the two mission teams will coordinate.

SpaceX's 35th NASA cargo mission to the International Space Station launched Oct. 13 and docked with the station's Harmony module on Oct. 15. Dragon carried more than 6,300 pounds of supplies and research hardware, including the final pair of ISS Roll-Out Solar Arrays. NASA says the arrays will finish the station's power augmentation. The extra electricity is meant to support research and operations, and the station's controlled deorbit later. Astronauts will install the arrays on spacewalks planned for later this fall. NASA has announced a news conference to preview U.S. spacewalks 100 and 101. The cargo also includes experiments on artificial retina manufacturing, 3D heart tissue models, and brain organoids for neurodegenerative disease research. The station now hosts the Crew-13 astronauts, who arrived Oct. 1 for a six-month stay.