Month: April 2023

Enlarge (credit: Getty Images)

Exploit code for a critical printer software vulnerability became publicly available on Monday in a release that may exacerbate the threat of malware attacks that have already been underway for the past five days.

The vulnerability resides in print management software known as PaperCut, which the company’s website says has more than 100 million users from 70,000 organizations. When this post went live, the Shodan search engine showed that close to 1,700 instances of the software were exposed to the Internet.

World map showing locations of PaperCut installations.

Last Wednesday, PaperCut warned that a critical vulnerability it patched in the software in March was under active attack against machines that had yet to install the March update. The vulnerability, tracked as CVE-2023–27350, carries a severity rating of 9.8 out of a possible 10. It allows an unauthenticated attacker to remotely execute malicious code without needing to log in or provide a password. A related vulnerability, tracked as CVE-2023–27351 with a severity rating of 8.2, allows unauthenticated attackers to extract usernames, full names, email addresses, and other potentially sensitive data from unpatched servers.

Enlarge (credit: Getty Images)

Exploit code for a critical printer software vulnerability became publicly available on Monday in a release that may exacerbate the threat of malware attacks that have already been underway for the past five days.

The vulnerability resides in print management software known as PaperCut, which the company’s website says has more than 100 million users from 70,000 organizations. When this post went live, the Shodan search engine showed that close to 1,700 instances of the software were exposed to the Internet.

World map showing locations of PaperCut installations.

Last Wednesday, PaperCut warned that a critical vulnerability it patched in the software in March was under active attack against machines that had yet to install the March update. The vulnerability, tracked as CVE-2023–27350, carries a severity rating of 9.8 out of a possible 10. It allows an unauthenticated attacker to remotely execute malicious code without needing to log in or provide a password. A related vulnerability, tracked as CVE-2023–27351 with a severity rating of 8.2, allows unauthenticated attackers to extract usernames, full names, email addresses, and other potentially sensitive data from unpatched servers.

Enlarge / Apple's MagSafe battery pack for iPhone. The headset's external pack is said to resemble these.

Bloomberg reporter Mark Gurman is at it again, sharing insider details about Apple's upcoming mixed-reality headset. This time, Gurman shared new details in his weekly newsletter about the headset's controversial tethered battery pack design.

Previous reports from Gurman, supply chain analyst Ming Chi-Kuo, and The Information revealed that after much internal debate, Apple decided to move forward with a headset design that works with an external battery pack connected by a wire.

This is because including the battery inside the headset would make it too bulky and heavy for some users. Apple employees against this approach argued that it made the headset clunky to use, especially in public.

• 

  Google's rendering of "The Meander," which will be "a central social gathering place with shops and local food." I assume there are office buildings in there somewhere.

For a while, Google has planned to build a new 80-acre mega campus that would take over a large chunk of downtown San Jose, California. If you expressed doubt that the modern-day shutdown-happy Google could commit to the "10-to-30-year" timeline for the construction project, congratulations! CNBC's Jennifer Elias reports that Google has put the idea "on pause" after just two years of construction.

Google got approval to start the project in 2021. The plan was to build an area twice as large as Google's recently finished "Bay View" headquarters, which is about 14 miles down the road. The 80-acre "mixed-use neighborhood" would have had 7.3 million square feet of office space, 4,000 housing units, 15 acres of "parks, plazas, and green space," and 500,000 square feet dedicated to "retail, cultural, arts, education, hotels and more." The project, called "Downtown West," had no estimated construction budget when it was announced, but some estimates said the finished work could be valued at $19 billion.

That was two years ago, though, and now Google is in the era of cost-cutting and earning Wall Street's approval, so it sounds like Google has shifted its priorities again. CNBC's report says that the project is now "on hold," and sources tell Elias that Google "doesn’t have plans to revive the project in the near future." Citing "internal correspondence," the report also says Google removed construction updates from the project's website last month.

Enlarge / A Fortnite loading screen displayed on an iPhone in 2018, when Apple and Epic weren't at each other's throats. (credit: Andrew Harrer | Bloomberg | Getty Images)

The 9th Circuit Court of Appeals has affirmed last year's district court ruling that Apple did not violate antitrust laws by forcing iOS developers to use its App Store and in-app payment systems. The decision is yet another major blow to Epic Games, which first challenged those Apple policies in a 2020 lawsuit.

"There is a lively and important debate about the role played in our economy and democracy by online transaction platforms with market power," the court wrote. "Our job as a federal court of appeals, however, is not to resolve that debate — nor could we even attempt to do so. Instead, in this decision, we faithfully applied existing precedent to the facts."

In a highly technical 91-page ruling issued Monday, the appeals court affirmed Apple's argument that the case centered around the market for mobile game transactions, rather than Epic's proposed definition of "aftermarkets of iOS app distribution and iOS in-app payment solutions." That market definition was a key point of contention in the original case, since it establishes that Apple faces competition from other mobile ecosystems like Android.

Enlarge / An AI-generated image of a "Stochastic Parrot" created by Stability AI. (credit: Benj Edwards / Stability AI / Stable Diffusion XL)

On Wednesday, Stability AI released a new family of open source AI language models called StableLM. Stability hopes to repeat the catalyzing effects of its Stable Diffusion open source image synthesis model, launched in 2022. With refinement, StableLM could be used to build an open source alternative to ChatGPT.

StableLM is currently available in alpha form on GitHub in 3 billion and 7 billion parameter model sizes, with 15 billion and 65 billion parameter models to follow, according to Stability. The company is releasing the models under the Creative Commons BY-SA-4.0 license, which requires that adaptations must credit the original creator and share the same license.

Stability AI Ltd. is a London-based firm that has positioned itself as an open source rival to OpenAI, which, despite its "open" name, rarely releases open source models and keeps its neural network weights—the mass of numbers that defines the core functionality of an AI model—proprietary.

Enlarge (credit: Getty Images | NurPhoto)

Twitter's big checkmark transition brought more of the chaos that has typified Elon Musk's run as owner and CEO of the social network. Over the weekend, Twitter applied checkmarks to the accounts of many well-known people who didn't pay for them—including some dead celebrities—along with a message that the accounts subscribed to the $8-per-month Twitter Blue service.

"This account is verified because they are subscribed to Twitter Blue and verified their phone number," states the message attached to accounts with blue badges, including those of Kobe Bryant and Chadwick Boseman. Meanwhile, living celebrities who got the same checkmark made sure to tell followers that they hadn't actually paid for a Twitter Blue monthly subscription or verified their phone number. It would be more accurate to say that Twitter gave free subscriptions to people with a large number of followers, whether they wanted the checkmarks or not.

A blue checkmark on Twitter used to indicate that an account was notable and that Twitter had verified that the person running the account was who they said they were. Now, some famous people who got the checkmark want to make sure that no one mistakenly believes they're giving Musk's company $8 a month. As Slate writes, Musk's decision to remove "legacy" checkmarks and make them a premium feature "turned the blue checkmark into a scarlet letter."