❌

Reading view

Over $600 Million In Polymarket Election Trades Took Place After Races Ended

An anonymous reader quotes a report from Wired: Prediction market boosters often tout the platforms as barometers of public opinion, or even "truth machines" offering a clearer picture of where things are headed than polling or other data. In 2024, for example, Kalshi beat many pollsters in forecasting the outcome of the US presidential race. But their trading activity can also tell more perplexing stories. Two global election markets on Polymarket's offshore platform, for instance, generated over $600 million in trading volume, far more than most political markets typically attract. Most of the activity took place buying and selling contracts tied to long-shot candidates who ultimately did not win. The report focuses on suspicious trading activity surrounding elections in Ethiopia and Romania, where researchers uncovered $284 million in questionable trades tied to Ethiopia's election and periods when 99.6% of trading volume in a Romanian election market was flagged as suspected "wash trading." According to Wired, "wash trading is a type of market manipulation in which accounts repeatedly buy and sell assets to create the illusion of heavy trading activity, when in reality, money is simply moving back and forth." Some accounts may also be artificially inflating their activity to qualify for potential cryptocurrency token rewards, a practice known as "activity farming." In response to the Ethiopian trading activity, Polymarket told Wired that the company "immediately flagged this activity, investigated, and blocked the accounts from trading." The company did not explain why the suspicious trades were allowed to continue for months before action was taken.

Read more of this story at Slashdot.

  •  

Video Game Reverse Engineering Community Shuts Down Because AI Has Made It Too Easy

The collaborative reverse-engineering site decomp.dev is shutting down, with its administrator saying AI has made game decompilation so fast and accessible that the community's human-driven model has effectively broken down. "The administrator of the website said that it has become impossible to keep track of which projects are primarily human-led and which ones are done by AI," reports 404 Media. From the report: "Historically, matching decompilation has been a brutally difficult, time consuming task, on the scale of years for any moderately-sized game with a number of active contributors," the pseudonymous admin of decomp.dev, who goes by Encounter, wrote on the site. But recent frontier AI models like GPT-6-Astra have made it trivially easy to decompile a game: "They are significantly better at following complex directions, cross-referencing resources for symbols or debug information, and writing natural code with enough guidance," Encounter wrote. "It is now clear that, with the right guidance, human input, and code reviews, AI can expedite the decompilation process in a significant way. What is also now clear is that the community aspect of decompilation has been broken."

Read more of this story at Slashdot.

  •  

China's Tencent Says AI Agents Showed Unintended Browsing Behavior

Tencent says AI agents used to evaluate third-party models engaged in unintended web-browsing behavior while trying to retrieve data from Alibaba's Amap service. The announcement marks a rare acknowledgment of "rogue" agent activity by a major Chinese tech company. Reuters reports: Tencent Hunyuan, the company's artificial intelligence unit, said in a post on X that the activity did not originate from its Hunyuan models. Its review found no evidence of deliberate targeting or coordination, it said. The Swarmchasers researchers said the agents sought information such as the commonly used entrances at Chinese parks, museums and zoos. [...] Swarmchasers said it used the word "rogue" to describe agents taking actions outside their intended scope or completing a task in unintended ways. After routine automated requests were blocked, the agents tried other methods, including public web tools that could open pages and run code, routing requests through other websites and using Amap keys and security codes found in publicly available software code. Swarmchasers said it found no evidence that the agents breached Amap's main anti-bot safeguards. Most of the 2,818 attempts it recorded either failed or returned anti-bot pages, login screens or blank results. Some requests returned information through cached pages and intermediary services, including data on visitor arrivals at Chengdu Zoo, Swarmchasers said. The researchers said they could not determine whether an agent read the result or completed its task.

Read more of this story at Slashdot.

  •  

Steam For Linux Finally Goes 64-Bit

Valve has released a new Steam Client beta that finally moves the Linux client to 64-bit architecture, while also placing it inside a containerized Steam Runtime environment. However, Linux users still need 32-bit libraries and graphics drivers for compatibility, meaning fully 64-bit-only systems remain unsupported. VideoCardz.com reports: Valve's updated requirements explicitly state that 64-bit-only installations are not supported. Systems must still provide both 32-bit and 64-bit libraries and graphics drivers, including multilib support. The new client also requires Linux kernel 5.6 or newer and glibc 2.31 or newer. The update also introduces Steam Achievement Sets, a feature we covered earlier that allows developers to organize achievements into separate groups for base games, DLCs and seasonal content. Players can complete individual sets without losing their existing completion status when developers add more achievements. Valve has also updated the achievements page to display progress across these groups. The 64-bit Linux client and Achievement Sets are currently available through the Steam Client Beta. Valve has not confirmed when these changes will reach the stable Linux release. Until then, users on the regular Steam client will continue using the existing architecture.

Read more of this story at Slashdot.

  •  

AI got my team updating the CRM more consistently, but I ended up asking them to write their own notes again

We recently rolled out attio, and there's a lot I like. Being able to ask AI to change views, move things around and summarize my deals is pretty cool. still finding it a little less intuitive than HubSpot (deals and companies are in same page, along with the list of contacts, for Attio I need to click into each field which is little annoying) which I used at my previous company but I'm getting used to it and learning more into AI

The bigger thing for me as a AE lead is the usual problem of getting everyone to actually update the CRM. always a tough one getting the top reps to stay hygenic.

Initially, I thought the AI agents helped. My team was happy enough to use them, and updates were getting done. But after a week or two, I started reading through the records and found notes scattered across different sections. There was information in Notes, in Description fields, but it was hard to follow, and some of the nuance was missing.

I tried using Grokbot to auto update my CRM as well but it just felt so clunky for me to set up let alone get my team to do it.

So I ended up asking everyone to write their own meeting notes again. Which felt a bit backwards after introducing all this automation.

I think I’m landing somewhere in the middle. If a field has a clear, factual value, great, automate it. For meeting notes, I still want the rep’s own account of what happened and what they think matters.

We already had Willow Voice across the company, mostly for our leadership to use, so I’ve started getting reps to dictate their CRM notes with it too. I give them all a structure to start off with and they can talk through a longer update without having to type everything out. Early days, but so far that’s been working better for us to have all the info in one place, and having all the point of a CRM plus it is also cleaned up.

How are other sales leads handling this? What do you let AI update. and what do you still ask reps to write themselves?

submitted by /u/Eye_Diddles
[link] [comments]
  •  

Meta May Use Sweeping New Commercial TOS to Avoid Millions In AI Licensing Fees

Meta is facing criticism over updated commercial terms taking effect October 30 that could give the company broad permission to scrape content from websites linked to business accounts and use it to train AI. Legal experts warn the changes could undermine lucrative AI licensing deals for news publishers, with no direct opt-out for businesses that accept the terms. Ars Technica reports: As Nieman Lab reported Thursday, this will affect all business accounts but is particularly shocking for news publishers who could perhaps charge Meta millions in licensing fees to continually access their articles for AI training. Currently news organizations are fighting a battle with OpenAI over whether such training without licensing is fair use, and Meta's terms seemingly risk granting it sweeping permissions, no matter which way the court leans. "While journalism isn't the only industry that will be affected by this update, virtually every news organization has at least one Meta business account, including Nieman Lab," the lab said. [...] Notably, there is no mention of AI, but it's inferred from a single use of the word "train" and references to automated scraping and crawling. Meta's spokesperson told Nieman Lab that Meta has no plans to use the terms as a legal basis to ignore robots.txt instructions that block scraping on news sites. The company still allows news organizations to opt out of scraping and provides instructions on how to block crawling. A spokesperson told Ars that "there is no change to how Meta uses web crawlers; any suggestion to the contrary is false." However, should courts affirm that AI training non-news articles is fair use, news organizations question if Meta's stance might change, and the terms could be used to freely grab access to content by legally overriding robots.txt instructions.

Read more of this story at Slashdot.

  •  

An OpenAI Research Agent 'Stole' Test Ethereum to Finish a Coding Task

An OpenAI research model reportedly accessed an Ethereum testnet wallet without permission in order to complete a coding task during internal training. "This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI wrote. Engadget reports: The incident, which occurred on June 26, happened while a GPT-5.6 Sol model was in internal training. The task involved updating a crypto trading prototype and deploying contracts (publishing special code) on an Ethereum test network called Sepolia. Payment of a network fee is required for such contracts, but OpenAI "supplied no funded wallet and gave no permission to spend funds from an account the model found independently," OpenAI said in the report. The lack of funds at first stymied the agent, but it was not to be discouraged. The model reasoned that it could use public developer recovery phrases (similar to those you might use to recover a password) to access keys from unauthorized accounts. It tracked down 362 addresses open to that avenue of attack and found one that held enough Sepolia ETH to finish its deployment (to be clear, Sepolia ETH has no value outside of testing). Like many criminals, the agent reasoned that someone must have left this access open for automated draining of the ETH "faucets." It also figured that the crypto was effectively "abandoned" and "valueless," according to OpenAI's misalignment records. The piece de resistance was that the agent "did not disclose that it had selected a funded account through a public recover phrase or spent that account's balance," OpenAI said. To prevent similar events in the future, the company is now monitoring all traffic and paging security if live internet access is detected.

Read more of this story at Slashdot.

  •  

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped

  •  

CoreWeave's Debt Stress Tests Private Credit's AI Financing Boom

An anonymous reader quotes a report from Reuters: Private credit's expanding role in financing AI infrastructure faced one of its clearest market tests this week as CoreWeave's bonds fell to distressed levels, raising questions about how lenders are pricing a boom built on chips, data centers and customer contracts. CoreWeave has about $50 billion of debt, according to LSEG data, making it one of the largest borrowers linking private credit to the AI buildout. The cost of insuring its debt against default climbed to about 1,200 basis points this week, while yields on some of its bonds rose to roughly 15% to 16%, signaling sharply increased investor concern over its credit risk. "There is still a price. Investors are still comfortable financing it, but they're demanding more compensation for it," said James Martin, senior US credit strategist at SMBC, referring to projects further from completion. Carlyle estimates that private credit could finance roughly $1 trillion of the AI infrastructure buildout but warns that aggressive lending could create concentration risks similar to those seen in software lending. "The clearest lesson is not to avoid AI compute exposure, but to set concentration limits before the buildout accelerates further, not after," Carlyle said.

Read more of this story at Slashdot.

  •  

Hacked site kept reinfecting itself after every cleanup. One of the causes was an admin's open browser tab

We clean up hacked WordPress sites for our clients and since July we've been fighting the same malware family over and over. It calls itself "SC" in its own files. If you've ever had a site get hacked again right after it was cleaned, some of this might sound familiar.

The weirdest one was a browser tab. We'd done a full cleanup, and then the malware plugin got uploaded again from a real admin's computer, logged in as that admin. We were about to tell the client their laptop was infected. It wasn't. That admin still had a tab open on the site from back when it was hacked, and the bad code in that tab was still running. Every minute it checked whether an admin was logged in, and as soon as one was, it uploaded itself again. They closed the tab and that was the end of it.

So now after every cleanup we tell everyone who uses wp-admin to close every tab on the site and restart their browser. Sounds silly. Cost us days.

The other big one was a saved password. This thing records every username and password typed into the login page. A site we cleaned in September got reinfected this week by someone who just logged in with a password it had saved back then. The owner never changed it. So everyone who logged in while the site was infected needs a new password, and 2FA on the admin accounts would have stopped that login cold.

Other stuff that tripped us up

  • It makes admin accounts that don't show on the Users screen, so the user list looks totally normal
  • It hides in files with normal WordPress names, so you won't spot it scrolling through the files
  • Part of it lives in the database, so restoring files or reinstalling plugins leaves that bit behind and it comes back later
  • Newer versions run a background process on the server that puts the files back within minutes, and restarting PHP doesn't kill it. If a host cleaned your site and it was back the same afternoon, that's one way it happens

Anyone else seen the browser tab thing? That was a first for us.

submitted by /u/TopSydeWP
[link] [comments]
  •  

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis

  •  

MainWP vs ManageWP vs WPMU DEV: What are you using? Why?

I currently manage around 20 sites, mostly for small businesses and nonprofits. I've been experimenting with MainWP, ManageWP, and more recently WPMU DEV, trying to find the best balance of reliability, backups, security, and ease of use. None seems to check all the boxes.

There has been a recent history of security vulnerabilities in the management plugins themselves. WPMU DEV recently had a pretty serious authentication vulnerability .... ManageWP and MainWP have had similar issues over the years. To WPMU DEV's credit, their response and patch turnaround seemed pretty quick.

I'm not necessarily looking for the cheapest solution. I'd rather pay a reasonable amount for something reliable that doesn't require constant babysitting.

A few things I'm particularly interested in:

  • How reliable have the connections been between your dashboard and individual sites?
  • What are you using for backups, and have you actually tested restores?
  • Have you had any security concerns with the management plugins?
  • How useful are the monitoring and reporting features?

I'm currently testing WPMU DEV on a couple of my own sites, and so far I'm fairly impressed. But I'm interested in hearing from people who have been using these platforms longer, especially those managing 15–30 sites or more.

What's working for you, and what drives you crazy?

submitted by /u/Tolstoy42
[link] [comments]
  •  

Website for my new business

So i've decided to build my own website for my business, since budget is short, and am doing this is Wordpress.

This is going to be a service based business, with both one-time paying customers, aswell as subscription based clients, this then entails that prices need to be shown different for both. And this goes for both my services and add-ons.

So i need a booking plugin that allows me to show different prices, depending on subscription type, and then also combine the available times, so i dont get double bookings.

Currently building with Astra and Elementor, with some help from a well-known friend (ChatGPT).

Any recommendations on plug-ins for; 1. Login, 2. Booking?

Any tips or tricks shared are more than appreciated :)

submitted by /u/Key_Target_7518
[link] [comments]
  •  

Help with HTTP ERROR 500

I've had a blog on Wordpress for years and I just noticed today that I'm getting an error when I'm trying to reach the site. I can't even log into Wordpress or edit in any kind of recovery mode like I have in the past. I'm going to be honest - I'm panicking because I haven't been able to get backups to work on my site and I have no idea how to read the error log. It looks like my last email from my website was about 2 days ago, so I feel like it has to be a recent error. Would anyone have any guidance for me to go about recovering or fixing this issue?

submitted by /u/Substantial_Salt_802
[link] [comments]
  •  
❌