Slashdot reader fjo3 shares an article from Wired: The internet must be put out of its misery. Any rational observer can admit that the current iteration of the web -- and the social fabric woven there -- is not what they signed up for. Symptoms of advanced cultural decay can no longer be ignored. This thing is eating itself. Giants including Meta and Google have been forced to settle massive consumer lawsuits brought over privacy violations and mental health harms allegedly caused by the addictive mechanisms of their platforms. Schools are banning smartphones as multiple countries institute social media restrictions for under-16s. Parents are in a panic about their kids aspiring to careers as social media celebrities, losing themselves in a vast ecosystem of online casinos, or joining extremist movements. Generative AI, briefly considered an amusing novelty, is now a turbocharged slop engine for the web, filling feeds and comment sections with useless, grotesque content. As humans scroll past headlines about AI taking their jobs, confusing fantasy for reality, and contributing to cognitive decline, any consumer appeal the technology might have is turning to anguish. The data centers that power it have become increasingly unpopular, and politically radioactive. To be online, many now admit, is to be endlessly manipulated and exploited. In December, Oxford University Press declared rage bait to be the word of the year, noting that use of the term had tripled over the previous 12 months. The lexical spike represented a heightened awareness that monetized social accounts churn out bad-faith takes and extremist content, automating this abusive behavior with generative AI, simply to profit off hostile engagement. Billionaire oligarchs have opened the floodgates to such inauthentic activity, conspiracy-mongering, and hate speech by rolling back moderation. In short, when you hang around online in 2026, you see little worth saving. Perhaps a decade ago, you felt that the glimmers of community and joy, of artistic and intellectual exchange, were enough to balance out the toxic junk. No longer.

Read more of this story at Slashdot.

The Browser Company is shutting down its Arc browser on December 22 and encouraging users to migrate to Dia, its newer AI-powered browser for Apple Silicon Macs and Windows 11 PCs. Thurrott reports: In the message explaining why it was sunsetting Arc, The Browser Company explained that maintaining two separate browsers was difficult to justify, especially from a security perspective. "Dia was built from the ground up to meet today's security standards, so that's where our engineering and security teams will focus moving forward," the company wrote. The retirement of Arc will be gradual: While nothing changes for existing Arc users, it's no longer possible to create new Arc accounts as of today. On November 23, tab sync, Browse for Me, and other AI features will be disabled on the iOS and Android versions of Arc. Lastly, the desktop version of Arc will stop working on December 22, and Arc accounts will be deactivated.

Read more of this story at Slashdot.

BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, "The PHP story feels like the cyber equivalent of an unexploded bomb -- I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet." Although no successful attacks have been confirmed, the AI-assisted discovery of long-hidden flaws has triggered a worldwide security scramble, with websites taken offline as a precaution and administrators racing to deploy patches before attackers can exploit the vulnerabilities. From the report: The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. [...] It was supposed to be kept quiet until everyone had a chance to fix their sites -- but the news was leaked. From that point the clock started ticking. As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. "There's a real dilemma," said Prof Alan Woodward from Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out." But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success. "We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," Gina Neff, Professor of Responsible AI at Queen Mary University, told the Today Program on BBC Radio 4. "We have enormous capability to handle these risks."

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10. "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory stated. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here. Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they "expect mass attacks to start within 15 minutes of the release." A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Read more of this story at Slashdot.

Independent researchers say they've identified a large "fleet" of AI agents apparently running on Tencent infrastructure and making parallel queries against Alibaba's Amap mapping service. TechCrunch reports: Researchers, however, resisted the term "swarm," noting that there seems to be little coordination between their different queries. "'Agent fleet,' not 'swarm:'" one researcher wrote in the preliminary report, "many parallel agents on the same kind of task, with no sign of communication between them." The agents were discovered by monitoring traffic to the domain-scanning service urlquery, a technique that previously revealed long-running activity by OpenAI agents. AI agents often use urlquery to load websites that they cannot access directly, leaving a record of their activities that can be valuable to researchers. In this case, the record showed queries to Alibaba's Amap service, seeking directions to different entrances of various public places, including a park, a zoo, and a hospital. The research is ongoing and so few details are available, but the behavior shows how persistent AI agent activity has become on the internet. In the wake of the Hugging Face incident, many researchers are actively monitoring for rogue agent activity on the internet. Much of that activity has been easy to find because agents tend to use the same techniques and make little effort to conceal themselves.

Read more of this story at Slashdot.

Cloudflare has launched two open-weight decision models, Clef and Clef-flash, designed for structured yes/no, multiple-choice, and ranking tasks while also supporting images, video, and up to a 64K context window. Cloudflare says its models outperform TypeSafe's Jev on several benchmarks and can run locally from Hugging Face. The Register reports: For starters, Clef has an LLM backbone. According to Cloudflare, Clef uses specially post-trained, frozen versions of Qwen3.8-27B and Qwen3.5-9B for Clef and Clef-flash, respectively, with the Qwen backbone performing a prefill-only pass during inference. Clef is still fast - faster than Jev, to be fair - and scores choices in parallel after that prefill-only pass. It's not clear what Jev's underlying architecture is, as TypeSafe has kept that a secret. As for its speed and capability, Clef moves fast. Cloudflare ran it against Jev and some other open decision models using the Jev Decision Index available on Hugging Face, and the company's own ranking suggests Clef is slightly slower than other open models, but more accurate, with Clef-flash just as accurate as most of the others, but far faster. To be fair to the competition, Cloudflare self-reported its own scores against the benchmark, and they have yet to be reproduced for ranking on the official Decision Index. Cloudflare also ran Clef against TypeSafe's own benchmarks, and claimed it beat Jev in three out of four areas, only losing out on agent trace observability. Even if it were a bit slower or less accurate, Clef has another major leg up on Jev: It's not limited to classifying text -- it can also handle images and video. Additionally, Clef supports a 64k context window. Jev can also handle up to 64k tokens across a request, although its state plus longest individual question is limited to 32k.

Read more of this story at Slashdot.

fahrbot-bot shares a report from CNN: President Donald Trump on Tuesday unveiled America.gov, a government website meant to serve as a one-stop shop for people trying to accomplish basic tasks like renewing a passport, enrolling in Medicare or applying for disaster relief. The site, which launched with some basic functions ahead of a full rollout next year, is designed to serve as an AI-powered guide through the thicket of government agencies that Trump officials pledged would ultimately save people a whole lot of frustration. The administration's new initiative aims to allow Americans to access dozens of federal websites through a single point, making America.gov akin to a search tool that pulls information from across the government. And in the same way that people increasingly use AI models like ChatGPT or Google Gemini to compile information and provide customized answers, Trump officials claimed that America.gov would be able to do the same for people's interactions with the federal government. Enrolling in Medicare, for example, will become a matter of typing the request into the America.gov AI tool and following its step-by-step instructions. The same goes for applying to a government job -- the new tool will now let people upload their resume directly to the site -- or answering questions about federal benefits, publicly available documents or other necessities that fall under the federal government's vast umbrella. "Our vision is that one day, this type of convenience and simplicity will be across every government service," said Joseph Gebbia, who leads the government's National Design Studio. But the reality is that the most advanced actions won't be available until some point in 2027, raising questions about how long it will take for the administration to revamp the way the people interact with the government's websites. The current version of America.gov can only do "answers." U.S. Chief Design Officer Joe Gebbia said the new chatbot is powered by Google's Gemini and Elon Musk's Grok. "We have great partners behind the scenes," Gebbia told CNBC's "Squawk Box" shortly before the site, America.gov, went live around 10 a.m. ET. "Google is proud to be named a technology partner in this vital initiative, leveraging Gemini to help more than 100 million people access critical public resources with greater speed and ease," the company said in a blog post. "By supporting the administration's vision for digital modernization, we are committed to making these everyday public services seamless, accessible, and responsive for all Americans."

Read more of this story at Slashdot.

IMDb is introducing "Digital Creator" as a new professional category on IMDb and IMDbPro, giving streamers, vloggers, influencers, video essayists, and other online creators a "dedicated way to represent [their] work and connect with audiences, industry peers, and potential employers," according to IMDb. Variety reports: The category includes sub-professions to further specify their work, including "Streamer," "Vlogger," "Video Essayist," "Video Creator," "Gaming Creator" and "Influencer." The "Digital Creator" designation functions as a professional category on IMDb and IMDbPro. Creators can feature multiple professions on their page, so someone who is both a digital creator and an actor can "represent the full scope of their work in one place," per the company. No existing film or TV credits are required to establish a profile as a Digital Creator.

Read more of this story at Slashdot.