Technology & Science

TOKYO — Japanese companies disclosed a new batch of data leaks on Wednesday. Muji operator Ryohin Keikaku said about 1.09 million customer records may have leaked, including credit card numbers. About 345,000 of the Muji Card records hold full numbers of currently valid cards plus birth dates. Late last month the company also reported that up to 27.26 million records may have leaked through its Muji app. Bic Camera said up to 14.9 million customer records, including email addresses, may have been exposed through a contractor that handles its newsletters, Arara Inc. Airdo (673,920 records), Solaseed Air (up to 490,000 addresses) and workwear maker Workman (up to 1.45 million) also reported exposure through the same email service. Nomura Investor Relations suspended its Institutional Navi service after unauthorised access was detected on Monday. It has not given a record count. Investigations are continuing.

MOUNTAIN VIEW, Calif. — Google announced Monday that it had disrupted XCPE, a botnet of more than 1.3 million Android TV set-top boxes. Its Threat Intelligence Group says with high confidence that Shenzhen-based manufacturer Videostrong Technology built the backdoor into its firmware on purpose. Affiliates allegedly used infected boxes for ad fraud, residential proxy services and loading further malware. Google took legal action against the botnet's domains and servers and against command servers for more than a dozen related malware families. It estimates this cut off access to at least 10 million more compromised devices. It also banned Videostrong and any future affiliates from making certified Android devices. The company says Videostrong evaded its certification tests by loading malicious code after first boot, and it has changed its review process. The takedown does not clean devices already sold. The backdoor reinstalls itself, so owners need clean firmware or should disconnect the boxes. Japan's National Police Agency and several security firms assisted.

Zyxel has patched a zero-day in its GS1900 series network switches, tracked as CVE-2026-107441. The flaw lets an unauthenticated attacker with network access run operating-system commands through the web management interface. It affects ten switch models. Zyxel released firmware fixes on October 22 and published its advisory on November 3. GreyNoise reported that a suspected Chinese-speaking actor it calls Kapibala compromised 996 switches in 48 countries from about August 17. The attackers copied device configurations and hashed root credentials. GreyNoise first blamed an older flaw, CVE-2026-7273, which Zyxel had patched in June, and CISA added that flaw to its Known Exploited Vulnerabilities catalog. Firmware-security firm Binarly later found the exploit still worked on fully patched switches. It reported the new bug to Zyxel on September 29. Administrators should install the latest firmware.

WASHINGTON — Voters on Tuesday backed restrictions on data centers, or rejected pro-development measures, in almost every local contest. CNBC, citing Ballotpedia, counted 41 data-center ballot measures in ten states. The one exception was Harwood, North Dakota, where voters rejected extra review of industrial projects, including data centers. Ohio held 21 of the measures. Democrats who campaigned on pausing or regulating projects won races in Ohio, Wisconsin, Georgia and Texas. In Texas, Gina Hinojosa unseated Gov. Greg Abbott. A CNBC voter poll found 56% of voters called data centers a crucial or major factor in their choice. The Washington Post counted at least 38 jurisdictions that passed bans or restrictions. Semafor reported that lenders have begun treating local opposition as a credit risk, and that hyperscalers are hiring community liaisons. The measures differ widely, from outright bans to temporary pauses and energy-use caps.

BEIJING — Moonshot AI put the weights for Kimi K3.1 Pro on Hugging Face on Thursday. Listings describe a roughly 2.8-trillion-parameter mixture-of-experts model with about 104 billion active parameters and a 1-million-token context window. The company reports scores of 65.7 on Terminal-Bench 4.0 and 94.2 on GPQA-Diamond. Separately, U.S. startup Ricursive Intelligence released Ripple-65B Preview, a 65-billion-parameter dense model that it says leads U.S. open-weight models on agentic-coding benchmarks with a TerminalBench 2.1 score of 80.52. It puts training cost at about $32 million. These are developer-reported results. Independent evaluations have not yet appeared, and license terms and real-world agent performance still need checking by outside testers.

SAN FRANCISCO — A compliance calendar from the law firm Astraea lists two near-term events for developers. Recommendations are due November 16 under a September 18 executive order, including one on requiring a 'kill switch' for frontier models. On November 18 the Ninth Circuit hears argument in xAI v. Bonta, a challenge to California's AB 2013, which reaches generative-AI developers with California users. The lower court found that xAI had shown a 'distinct possibility' of success but not a likelihood. The tracker also notes about November 28 as the deadline for a federal proposal defining 'Super Intelligence.' Many state laws take effect January 1, 2027, including New York's RAISE Act. Colorado's enforcement is paused under a stipulation in the xAI litigation. The dates come from a law-firm tracker and should be checked against the underlying orders and dockets.

SAN FRANCISCO — Anthropic has released a beta integration that lets businesses run endpoint detection and response sensors inside the local virtual machine used by Claude Cowork, its desktop agent product. Security software on the host cannot normally see the shell commands and code that Cowork executes within that isolated environment. Under the new setup, that activity can flow to the company's existing security console. The change addresses a visibility gap that security teams have raised about autonomous agents. Anthropic has not published adoption figures. Separately, a new Anthropic usage policy is reported to take effect November 12, banning unauthorized distillation of Claude outputs and use of the models for malware or fraud. That policy report comes from a news digest and has not been checked against Anthropic's own page.

WARSAW — A University of Warsaw team led by archaeologist Dagmara Socha tested hair and nail samples from eight frozen Inca mummies recovered from mountain shrines in Peru and Argentina. The peer-reviewed results appear in the journal Antiquity. Every individual had taken at least one intoxicant. Cocaine, from coca leaves, was found in all eight. Four showed evidence of alcohol, probably from maize beer. Harmine, an alkaloid associated with plants used in ayahuasca, was found in the mummy known as the Lady of Ampato. The mummies were victims of capacocha, a major state ritual in which children and young women were sacrificed. Earlier studies had mostly found coca, or had inconclusive or negative results for other substances. The authors say newer toxicology methods can detect trace amounts. The differences among the mummies suggest the ritual was not carried out identically across the empire. The sample is small, at eight individuals.

PHILADELPHIA — Researchers at Fox Chase Cancer Center have identified a protein, ANO6, that helps pancreatic tumours draw on cholesterol. The work was published Oct. 30 in the peer-reviewed journal Nature Cancer. According to the paper and the centre's statement, ANO6 lets cancer-associated fibroblasts, the support cells in a tumour, pass cholesterol and other fats to pancreatic cancer cells. The transfer also dampens the immune cells sent to attack the tumour. Drugs that blocked the protein reduced tumour weight in mice. The researchers note the exchange is only one of several ways pancreatic cancer cells obtain fats, so blocking it alone may not be enough. The work is early-stage laboratory research. No patients have been treated, and it is not known whether the effect would carry over to people. Pancreatic cancer is among the hardest cancers to treat, and the finding identifies a possible new drug target.

GREENBELT, Md. — NASA's two ESCAPADE spacecraft return to Earth this weekend for a maneuver the agency says no NASA spacecraft has flown before, and each will do it once. The first probe makes its closest approach and fires its engine around 5 a.m. EST Saturday, Nov. 7. The second follows around 6 a.m. EST Monday, Nov. 9. Each will pass 600 to 1,100 miles up and burn for about nine minutes over southern Australia. That adds more than 1,000 mph, taking each probe to about 6.7 miles per second. The mission launched in November 2025 and spent a year looping around the Earth-Sun L2 point to wait for the planets to align. The probes should reach Mars on Sept. 7 and 9, 2027, and will be the first pair to fly in formation there. Backyard observers will need a telescope to spot them.

WASHINGTON — President Trump signed a proclamation on Nov. 3 titled the American Declaration of Freedom in Space. It describes space as the province of all humans and says it is open to exploration, development and a permanent American presence under U.S. law. The text cites the Apollo landings, Mars rovers and the commercial space sector. It creates no new NASA programs, provides no money and gives agencies no instructions. Axios called it largely symbolic and said it reinforces a December 2025 order seeking a lunar return by 2028. The language appears consistent with the 1967 Outer Space Treaty, which bars national sovereignty claims on celestial bodies, and with the Artemis Accords. Victoria Samson of the Secure World Foundation told Axios the 2028 goal is "wildly optimistic." NASA's Artemis III Earth-orbit test is planned for 2027, and Artemis IV, the first landing, for 2028.