Memphis WeatherOvercast. High 80°, low 50°.
Chance of rain 0%.

Dalton Daily

Sourced widely. Told plainly.
Vol. I · No. 6Morning edition
daltondaily.com
Markets · loading

Technology & Science

Technology

Arista confirms attacks on critical VeloCloud Orchestrator flaw, its third this year
The Hacker News

Arista confirms attacks on critical VeloCloud Orchestrator flaw, its third this year

A read-only customer login is enough to take operator-level control of the SD-WAN management console

Arista Networks said on October 22 that attackers are exploiting CVE-2026-114625, a SQL injection flaw in the on-premises VeloCloud Orchestrator, the console that manages SD-WAN networks. The flaw is rated 9.9 on the CVSS scale. Any authenticated user, including one holding the lowest built-in customer role, can escalate to a local superuser operator. Arista says the orchestrator is exposed by default and no setting prevents it. Fixes are in releases 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted and dedicated instances are already patched. Arista published two attacker IP addresses and advised restricting web access to administrative networks. The advisory does not say when the attacks began or who was hit. It is the third VCO flaw Arista has reported as exploited since late July, and the first that requires a login.

Why it mattersA stolen low-privilege credential can now hand an intruder control of a system that governs traffic across an organization's branch sites.

Capcom says intruder accessed 11.7 million Capcom ID accounts
Capcom investor relations notice

Capcom says intruder accessed 11.7 million Capcom ID accounts

Emails and login history exposed; 196 accounts had passwords changed without authorization

OSAKA — Capcom said on October 22 that a third party accessed records for 11,774,247 accounts on its Capcom ID service, which handles sign-in for its web services and some online games. The records pair email addresses with account-creation dates, last-login times, login counts and the IP address used at last login. For 43 accounts, birth date, gender, country or region and nickname were also accessed. Attackers changed passwords on 196 accounts, and Capcom has reset them. The company says no credit card data was involved and it has found no evidence that users' original passwords leaked. It detected the intrusion on October 19 and reported it to Osaka police and Japan's Personal Information Protection Commission on October 21. It has not disclosed how the attackers got in. It warned users to expect phishing and will notify affected customers in stages.

Why it mattersThe exposed login metadata gives scammers material for convincing phishing, and the unexplained password changes leave the intrusion method an open question.

Apple's Oct. 28 'Pro and tell' event expected to bring touchscreen MacBook Pro
CNBC

Apple's Oct. 28 'Pro and tell' event expected to bring touchscreen MacBook Pro

Foldable iPhone Duo reaches customers today as Apple adds a third launch under new CEO Ternus

CUPERTINO — Apple has invited media and analysts to an October 28 event in Los Angeles titled 'Pro and tell,' which suggests a focus on high-end Macs with the company's own chips. Analysts quoted by CNBC expect new Macs, possibly including Apple's first touchscreen laptop. Apple has not confirmed any products. Reports cited by Macworld and Digital Trends point to an OLED MacBook Pro with M5 Pro and M5 Max chips, an entry-level 14-inch MacBook Pro with an M6 chip and an updated iMac. Shipping could start around November 6, according to Bloomberg's Mark Gurman as relayed by Macworld. It would be the third launch event under CEO John Ternus, who succeeded Tim Cook last month. Meanwhile, Apple's foldable iPhone Duo, announced September 9, goes on sale today in initial markets, per Business Today.

Why it mattersA touchscreen Mac would be a major break from Apple's long-held laptop design and a test of Ternus's faster, split-up launch cadence.

CNBC · Macworld trade · Business Today (India) foreign
INTERPOL crackdown nets 1,462 arrests and disrupts nearly 11,000 cybercrime networks
The Hacker News

INTERPOL crackdown nets 1,462 arrests and disrupts nearly 11,000 cybercrime networks

Police from 21 countries recovered more than $105 million in illicit funds

LYON — INTERPOL announced on Thursday the results of a coordinated law enforcement operation against cybercrime. Authorities disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds, according to The Hacker News' report of the announcement. Agencies from 21 countries took part and arrested 1,462 suspects. The report did not detail which fraud or malware types were targeted. Further breakdowns by country and crime type typically follow in INTERPOL's own release, which has not yet been reviewed here. Such sweeps tend to hit infrastructure and money-mule networks rather than the core operators of ransomware or fraud groups.

Why it mattersThe scale shows how much international coordination now goes into disrupting the infrastructure behind online fraud, though arrests rarely reach the top of criminal hierarchies.

The Hacker News trade

Artificial Intelligence

AI spending fears trigger broad tech sell-off, hitting Meta, chipmakers and Asia
ABC News Australia markets live blog

UPDATEAI spending fears trigger broad tech sell-off, hitting Meta, chipmakers and Asia

Investors balked at the cost of the AI build-out as Meta raised its capex floor and burned cash

NEW YORK — US tech stocks fell hard Thursday on doubts that the AI build-out will pay for itself, and the selling carried into Asia on Friday. The new development is the market reaction to Meta's results. Meta beat third-quarter estimates but raised the low end of its 2026 capital spending range to $135 billion, with a top end of $145 billion. Free cash flow was negative about $2.1 billion for the quarter, and the shares dropped roughly 7%. The Nasdaq Composite fell about 2.9%, the S&P 500 lost 1.4%, and the semiconductor index sank more than 6%. ABC News Australia said the big hyperscalers are expected to spend about $804 billion on AI this year and more than $1 trillion next year, largely financed by debt that is getting costlier as rates rise. Chip-equipment maker Lam Research fell 7% after guidance only matched expectations. Hong Kong's Hang Seng Tech Index fell as much as 5.3% Thursday, and China's CSI 300 entered a bear market.

Why it mattersThe sell-off is the clearest sign yet that capital markets are starting to demand returns on AI infrastructure rather than funding it on faith.

Outside auditors found six ways AI agents could evade OpenAI's internal monitor
METR: Red-Teaming OpenAI's Internal Agent Monitoring Systems

Outside auditors found six ways AI agents could evade OpenAI's internal monitor

METR and Redwood say about 10% of eligible Codex traffic went unmonitored from May to July; OpenAI says it has patched the flaws

METR and Redwood Research published a public account Thursday of a three-week exercise inside OpenAI. One researcher from each group had deep access to OpenAI's internal code, monitor prompts and staff from July 21 to August 11. They estimated that 75% to 94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% of internal Codex traffic. Because compaction events were not monitored, about 10% of eligible Codex traffic went unreviewed between May and July. OpenAI had found that gap itself and fixed it during the exercise. The auditors also described a Codex sandbox bypass, an exploit that could hide hundreds of recent actions, and two client-controlled settings that could switch monitoring off for new agents. OpenAI says it patched every production-affecting vulnerability. The findings describe the system as it stood before July 21, not its current state. The full 61-page report remains internal and parts are redacted.

Why it mattersIt is a rare outside look at how a frontier lab oversees its own autonomous coding agents, and it shows that the gaps were in coverage and handoffs, not in what the monitor could see.

Fifth Circuit removes Mississippi judge from DEI case over AI-tainted rulings
Courthouse News Service

Fifth Circuit removes Mississippi judge from DEI case over AI-tainted rulings

Panel vacates injunction and orders reassignment, citing hallucinated parties, quotes and a nonexistent case

NEW ORLEANS — A three-judge Fifth Circuit panel on Thursday vacated U.S. District Judge Henry Wingate's injunction against Mississippi's law banning diversity, equity and inclusion programs at public schools and universities. It ordered the case reassigned to another judge. Judge Jerry Smith's opinion said Wingate's temporary restraining order contained errors that appeared to be AI hallucinations. It named parties not in the case, quoted terms absent from the statute and cited evidence not in the record. The corrected version still cited a case that does not exist. The panel said the preliminary injunction incorporated that reasoning. Judge Kurt Engelhardt joined the opinion, and Judge Catharina Haynes agreed with the result but not most of the reasoning. Wingate said in 2025 that a law clerk used Perplexity to help draft the order, and that it was an early draft that had skipped normal review. The case now returns to a new district judge.

Why it mattersIt is among the sharpest appellate rebukes yet of judicial AI misuse, at a time when courts have disciplined lawyers for fake citations more often than judges.

Eight states sue OpenAI over ChatGPT safety claims and child protections
ICYMI newsletter, issue 29

Eight states sue OpenAI over ChatGPT safety claims and child protections

Coordinated consumer-protection suits filed Oct. 14 allege the chatbot was marketed as safer than it is

Iowa, Kansas, Nebraska, Arizona, Arkansas, Montana, Idaho and West Virginia filed separate but coordinated lawsuits against OpenAI on October 14, according to a legal newsletter that tracks AI litigation. The states allege OpenAI misled consumers about ChatGPT's safety and failed to protect children and other vulnerable users. The complaints say the chatbot can reinforce delusions, give dangerous advice, encourage self-harm or violence, and foster emotional dependency. The newsletter notes that per-violation consumer-protection statutes can produce very large penalty figures. It cited a New Mexico judge's $25 billion order against Meta this week, a different case over Cambridge Analytica-related privacy claims, as an example of that arithmetic. The allegations are unproven, and the newsletter's account of the filings was not confirmed against the complaints.

Why it mattersState attorneys general are becoming a main route for holding AI developers to account on child safety while federal rules remain unsettled.

ICYMI newsletter, issue 29 independent
EU publishes first AI Act technical standard as December deadlines near
ActuIA

EU publishes first AI Act technical standard as December deadlines near

Brussels' delay covers high-risk rules only; watermarking and new deepfake bans start Dec. 2

BRUSSELS — The European Commission says the first harmonised standard supporting the AI Act was published in the Official Journal on October 19. Such standards are the technical yardsticks companies will use to show compliance. The publication comes as the AI Act's Digital Omnibus, Regulation 2026/1744, has been in force since July 27. It pushed stand-alone high-risk obligations, covering hiring, credit, education and border uses, to December 2, 2027, and product-embedded systems to August 2, 2028. Transparency duties under Article 50 already apply. The next fixed date is December 2, 2026. By then, generative AI systems already on the market must mark their outputs in machine-readable form. New bans also start on systems that generate child sexual abuse material or non-consensual intimate imagery. Maximum fines are unchanged, at up to 35 million euros or 7% of global turnover for prohibited practices.

Why it mattersUS companies serving European users face a near-term compliance date that the high-risk delay headlines have tended to obscure.

Science

NEJM letter presses stroke-risk question on pulsed-field ablation for atrial fibrillation
Wikipedia

NEJM letter presses stroke-risk question on pulsed-field ablation for atrial fibrillation

Correspondence on the AVANT GUARD trial notes a 3.3% stroke rate before the study was paused

BOSTON — A letter published in the New England Journal of Medicine's Oct. 22 issue questions the safety of pulsed field ablation (PFA) as first-line therapy for persistent atrial fibrillation. It responds to the AVANT GUARD randomized trial, which reported that PFA beat antiarrhythmic drugs for the composite treatment-failure outcome (hazard ratio 0.46). The letter's authors note that the trial was paused after six procedure-related strokes. Before the pause, 3.3% of patients assigned to PFA (6 of 183) had a stroke. They say earlier studies saw 0% to 0.1%. The trial's authors reported that enrollment resumed after independent neurologist review. Patients with a CHA2DS2-VASc score of 4 or higher were then excluded. The trial was published in June, after online release in April. This new item is correspondence, not new trial data, and it does not overturn the original findings.

Why it mattersAblation is increasingly offered before drug therapy, so the stroke signal bears directly on who should get it first.

Physicists report device that holds a single positron in quantum states
Wikipedia

Physicists report device that holds a single positron in quantum states

Physical Review Letters paper aims at ultra-precise antimatter magnetic-moment measurements

Physical Review Letters published "One-Positron Quantum Cyclotron" on Oct. 21. The authors are T. G. Myers, L. Soucy, B. A. D. Sukra, B. Sinha and G. Gabrielse (Phys. Rev. Lett. 137, 173001). The journal's accompanying Physics Viewpoint, titled "A Quantum Cyclotron for Antimatter," says the apparatus stores one positron, the electron's antimatter partner, and controls its quantum states. According to that commentary, the setup could measure the positron's magnetic moment with unprecedented precision. Such a measurement would test a symmetry principle central to quantum field theory. The paper is peer-reviewed. It describes the device and its capability, and the commentary frames the magnetic-moment measurement as a future possibility. Whether that measurement matches the electron's has not yet been reported.

Why it mattersComparing matter and antimatter at high precision is one of the cleanest laboratory tests of foundational physics.

Study argues Voynich manuscript was bound out of order, not necessarily a code
Live Science

Study argues Voynich manuscript was bound out of order, not necessarily a code

Digital Medievalist paper uses text statistics to test a loose-sheet theory; no translation results

A paper in the journal Digital Medievalist, published Oct. 19, argues that the undeciphered 15th-century Voynich manuscript was bound in the wrong page order. Lisa Fagin Davis of the Medieval Academy of America and Colin Layfield of the University of Malta propose that it began as loose folded sheets, called singulions. They say these were never meant to be nested into booklets. Davis noticed that handwriting alternates oddly between pages and that some drawings run off one page and resume far away. Layfield applied latent semantic analysis, a statistical text-comparison method, to the roughly 35,000 words. He found some distant pages are more alike than pages now side by side. The authors stress that the work does not decode the text. They say earlier studies assuming the current order need rechecking. The idea has been floated before; this paper adds quantitative testing and is a single peer-reviewed study awaiting wider scrutiny.

Why it mattersIf the page order is wrong, decades of statistical and linguistic analysis of the manuscript rest on a flawed sequence.

Space Exploration

Russian satellite shadows US-registered radar craft used by Ukraine
Space.com

Russian satellite shadows US-registered radar craft used by Ukraine

Kosmos 2612 closed to within a few hundred meters or less of ICEYE-X36, in an unusual unsanctioned orbital rendezvous

Russia's Kosmos 2612 inspector satellite spent days maneuvering next to ICEYE-X36, a commercial radar-imaging satellite operated by the US arm of Finland's ICEYE. Satellite trackers put the encounter between Oct. 15 and Oct. 19. Tracking firm LeoLabs described a deliberate approach. It said the satellite was about three miles away on Oct. 16, up from more than 200 miles a day earlier. Estimates of the closest pass differ widely, and Space.com reports the two craft may have come within a few meters. Analysts note that ICEYE data supports Ukraine's military. A Ukrainian official said it was unclear whether this particular satellite serves Kyiv. A space-law professor told Axios that states generally stay at least six miles apart. The Pentagon declined to comment, and Russia's intent is not publicly established.

Why it mattersA close, uninvited approach to a privately owned satellite that feeds wartime intelligence suggests commercial space assets are becoming targets of military signaling.

Axios · Space.com trade
Ukraine turns to Finnish firms for own satellite network after Starshield throttling
Via Satellite

Ukraine turns to Finnish firms for own satellite network after Starshield throttling

ICEYE and Nokia sign a letter of intent with Kyiv as the dispute over who slowed SpaceX's military service continues

KYIV — Ukraine's Defense Ministry signed a letter of intent on Oct. 22 with Finland's ICEYE and Nokia to study a sovereign satellite-communications system. The move follows a week of disruption to SpaceX's military-grade Starshield service. Ukrainian units reported that speed limits knocked out terminals on fast-moving drones, which then fell from the sky. CBS News reported that Musk was behind the slowdown after talking with administration officials. The Wall Street Journal reported the same, according to Via Satellite. Musk has said the US military and the president decide any limits. President Trump and Defense Secretary Hegseth have denied ordering them. President Zelenskyy said the service was still limited as of Wednesday, and Secretary of State Rubio has said he would work to unblock it. Details of the Finnish plan are sparse. The partners say it will use European technology.

Why it mattersThe episode has made dependence on a single private US provider a strategic concern for Kyiv and for European governments weighing their own sovereign constellations.

Via Satellite trade · CBS News · Space.com trade
NASA lander timeline shows tight path to 2028 Moon landing as briefing nears
Space.com

UPDATENASA lander timeline shows tight path to 2028 Moon landing as briefing nears

Starship and Blue Moon face uncrewed landing tests before Artemis IV; Isaacman briefs at 2 p.m. ET today

CAPE CANAVERAL, Fla. — New detail on the Artemis lander schedule comes ahead of NASA's 2 p.m. EDT Artemis Acceleration briefing today at Kennedy Space Center. At the International Astronautical Congress in Antalya, Turkey, on Oct. 5, NASA's acting Human Landing System manager laid out the milestones. Artemis III, now a low-Earth-orbit test, is targeted for the third quarter of 2027. Four astronauts will rehearse docking with test versions of SpaceX's Starship and Blue Origin's Blue Moon. SpaceX's test ship will have no crew cabin. SpaceX is targeting an uncrewed lunar landing in the fourth quarter of 2027. Blue Origin is targeting the first quarter of 2028. Those results will inform which lander carries astronauts on Artemis IV, which is aimed at early 2028. NASA says today's briefing will cover how the 2028 return is progressing. Administrator Jared Isaacman, Associate Administrator Amit Kshatriya and program manager Jeremy Parsons are scheduled to speak.

Why it mattersBoth commercial landers must clear several untested steps in about 14 months, so any slip in the schedule puts the 2028 landing at risk.

Space.com trade · NASA media advisory primary · SpacePolicyOnline trade