Voices Beta

Welcome to the world, iPhone Duo! It’s such a delight to see the excitement of our customers around the world as they experience the magic of iPhone Duo for the very first time.

iPhone Duo is here! Loved celebrating its arrival with our teams in Austin this morning.

We are not slowing down. 🚀 Our Artemis III mission will send four astronauts to low Earth orbit next year to test critical systems needed for future lunar landings and we’re accelerating efforts to ensure the success of Artemis IV, the first Artemis mission on the lunar surface .

So one of the interesting things that came out today was SLS + Orion getting taller. Centaur V is getting 50% more propellent, and then a kick stage might be added underneath the service module for lunar orbit injection. I'm trying to think what the kick stage might be based on. It could be as simple as a stripped down service module without the power and panels and just one engine. SpaceX already has the ISS boost kit that fits inside dragon's trunk, it might fit the bill, especially with a Super Draco. Impulse might be able to adapt one of their space tugs to this role. Any other ideas?

An update to our threat brief on PHP CVE-2026-109618 & CVE-2026-109619: We observed an attack using agentic AI platforms for rapid post-exploitation and access to MFA secrets within 2 hours. Read the updated brief for analysis and hunting queries: bit.ly/4z7Txr2

Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.

A more than 40% risk reduction “would send many researchers over the Moon”. This personalised mRNA vaccine reduced the risk of skin cancer returning or the recipient dying by 42% go.nature.com/4izbJnE

.@JensenHuang's visit comes as @FirebirdCloudAI and Kazakhtelecom expand NVIDIA-powered computing infrastructure, with Firebird planning a Kazakhstan lab to help local startups and researchers build on it. See what’s taking shape in Kazakhstan: blogs.nvidia.com/blog/kazakhsta…

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain: Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either: a) a world-class exploit developer with an extreme case of imposter syndrome. b) currently looking at some very confident-sounding but wrong LLM output. I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works. I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself). The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off". People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media. So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector. What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't). The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations. LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

Scoop: ABC has wiped staff devices exposed to malicious ads from an Israeli company that used digital advertising to hack and track devices without a click. ABC is just one of many Australian government/critical infra/media orgs reportedly targeted