❌

Reading view

PA measles outbreak tops 1,000 cases, largest since disease was eliminated

Pennsylvania's explosive measles outbreak is now the largest the US has seen since the highly infectious virus was declared eliminated in 2000. With well over 1,000 cases, it's the largest on record since 1991.

Pennsylvania's health officials reported 1,078 measles cases in all of 2026 as of this afternoon. That includes 12 cases in January and March, with the remaining 1,066 cases since April, when the current outbreak began. The tally includes 145 cases recorded in the last seven days and 74 identified since the previous update on Monday. Health officials noted that 40 of the 74 cases added today were from more than two weeks ago and are just now being recorded.

Among the cases, there have been 207 hospitalizations and five deaths—a newborn, a 6-week-old, an 18-year-old, a 20-year-old, and a 40-year-old. All of the deaths occurred during the current outbreak in people who were unvaccinated; the two infants were too young to have been vaccinated.

Read full article

Comments

© Paul Hennessy/NurPhoto via Getty Images

  •  

TP-Link problems in US grow amid FCC router ban and four state lawsuits

TP-Link is facing more legal troubles in the US as Florida and three other states filed lawsuits alleging that it lied to consumers about its connections to China and the risks of its routers being exploited by Chinese state hackers.

The lawsuits were filed yesterday, about six months after the Federal Communications Commission announced a sweeping ban on consumer-grade routers produced wholly or partly outside of the US. Numerous router makers have obtained exemptions to the ban, but the Trump administration so far has not granted one to TP-Link.

Router makers that received exemptions include Netgear, Asus, Adtran, Amazon and its Eero subsidiary, Calix, Nokia, SpaceX's Starlink division, and others. For now, TP-Link is unable to sell its latest Wi-Fi 8 routers in the US, though models approved before the ban can still be sold.

Read full article

Comments

© TP-Link

  •  

Chemistry Nobel goes to reactions like those that gave life a hand

Life is remarkably selective. Life relies on many molecules with what is termed "handedness"—they're chemically identical but are mirror images of each other. Most chemical reactions will make a 50-50 mix of the left- and right-handed forms of a chemical, but life uses only one of them. In fact, because of the differences between left- and right-handed chemicals, most of the key enzymes used by organisms will fail to work if they're presented with chemicals that have the wrong handedness.

That poses a bit of a challenge for origin-of-life research, as we're forced to explain how a world that may have started with an even mix of left- and right-handed chemicals produced organisms that only used one of them.

Today's Nobel Prize in Chemistry goes to two individuals, Henri Kagan and Kenso Soai, who discovered chemical reactions could be biased, producing large excesses of one of the two forms of a chemical.

Read full article

Comments

© ollaweila

  •  

Pediatricians renew call to ban raw milk as anti-science rhetoric reigns

As many doctors are moving ahead with the latest advances of modern medicine—from powerful obesity drugs to breakthrough cancer treatments—pediatricians are being forced to turn back, fighting to maintain advances in children's health that were hard-won decades ago.

With anti-vaccine advocate Robert F. Kennedy Jr. as health secretary, the American Academy of Pediatrics (AAP) has spent a considerable amount of time and resources in the past year fiercely defending lifesaving vaccinations—safe, routine shots that have saved the lives of millions of children over decades and thwarted untold suffering and disability.

But just this week, The New York Times reported that Ken Paxton, the attorney general of Texas, has opened aggressive investigations against pediatricians simply because they vaccinated their patients. Paxton falsely claims vaccines are part of a "multi-level, multi-industry scheme." But critics say his anti-vaccine campaign appears more aimed at currying favor with Kennedy, President Trump, and their supporters as Paxton runs for the US Senate.

Read full article

Comments

© Getty | Matthew Ludak

  •  

Fraudster jailed for using 10K bots and AI songs to outstream Taylor Swift

After pleading guilty, a 54-year-old North Carolina man, Michael Smith, was sentenced to 18 months in prison for using artificial intelligence to generate songs for a scheme that stole millions from music streaming platforms.

In a press release Tuesday, the US Department of Justice said that Smith is the first American criminally charged with AI-assisted streaming fraud.

First charged in 2024, Smith successfully ran the scheme for seven years without detection.

Read full article

Comments

© Taylor Hill / Contributor | FilmMagic

  •  

Jaguar Type 01 debuts; now, no one remembers the electric Ferrari

Does it feel like people are perhaps a little grumpier or more on edge these days? It’s not like it’s without reason. There are wars. The climate is going haywire. Someone just died of plague. Scientific research is under attack. Machines keep stealing humans’ work. The media is a mess. And just when it all starts to feel a little overwhelming, Jaguar goes and unveils a new car.

The Type 01 is the first model to arrive from Jaguar’s rebirth. The British carmaker was an early entrant to the modern EV market with the 2017 I-Pace, which was fun to drive even if it was too small inside and perhaps completely unreliable. An all-electric sedan was supposed to be next, but a year from the showroom, it was abruptly canceled, leaving the automaker with nothing to sell as old models like the F-Pace ceased production.

Instead, Jaguar got to work on an all-new electric vehicle platform called JEA, which will underpin an all-electric product line. An elevated ownership experience and a starting price of about double the brand’s previous $60,000 entry point was the idea, Jaguar boss Rawdon Glover told me in 2024. Then last year the brand started teasing its relaunch, and everyone got upset. Things got even worse when the first images of the slab-sided and pastel-shaded Type 00 coupe concept leaked.

Read full article

Comments

© Jaguar

  •  

Trade group crunches numbers on Trump’s impossible push for 100% US-made tech

One of Donald Trump’s biggest goals as president is to increase domestic manufacturing and reshore supply chains so that the most in-demand technologies in the world can be 100 percent made in the United States.

By executive order last December, he launched his “Genesis Mission,” an ambitious plan seeking to leverage US dominance in AI to maintain or seize an edge in advanced robotics, biotechnology, semiconductors, and nuclear technologies. According to Trump, that plan works best with self-sustaining supply chains. Not even neighboring countries or longtime allies should be relied upon to manufacture a single component of any US product in his ideal world.

The Consumer Technology Association (CTA) has long warned that Trump’s reshoring goals are not grounded in reality, but only recently has America’s largest technology trade association attempted to estimate what it would cost businesses and consumers to follow through on Trump’s plan.

Read full article

Comments

© sefa ozel | iStock / Getty Images Plus

  •  

Mistral says "Le Chonk" can challenge the best AI models

As tensions mount over who gets access to top-end artificial intelligence, French company Mistral has released a new freely available model that it claims can compete with the very best from the US and China.

The new 1 trillion-parameter model, Mistral Large 4—nicknamed Le Chonk—can be used and customized by anyone. It’s currently available in preview, with a final version to follow by the end of the month. Though Le Chonk is built to compete with leading general-purpose models, it’s optimized specifically for coding and cyberdefense, as well as tasks particular to manufacturing, finance, electrical engineering, and other niches.

“There are a lot of areas where the other labs will not focus that much,” Guillaume Lample, cofounder and chief scientist at Mistral, tells WIRED. “There are so many domains in which you can improve models.”

Read full article

Comments

© Mistral / Benj Edwards

  •  

Google rolls out improved SynthID AI content detector, now available globally

Every piece of AI content from Google's Gemini models has a hidden SynthID label, which makes it very difficult to pass the content off as authentic. SynthID has also gotten buy-in from other major AI players, but actually checking for those invisible watermarks has been a convoluted process. It's going to be a little easier going forward, though. Google has announced that its SynthID detector now supports watermarks from all its partners, and it's available for anyone to use on a new dedicated website.

SynthID is an invisible signal encoded in the pixels of AI-generated images and videos, and in the waveform of AI audio. Google says Gemini alone has integrated SynthID with over 180 billion images and videos, plus 240,000 years of audio. Until now, the only way for those outside of Google's trusted tester program to check for SynthID was to ask Gemini. This is rather clunky, and the model's output could sometimes be confusing when you just wanted a simple "yes" or "no."

Now you can cut Gemini out of the loop. Starting today, you can go to the new SynthID.com website to check a piece of content for an AI watermark. A major limitation of Google's previous detector was that it only checked for Google's version of SynthID. Even though ChatGPT images, for example, have SynthID, they wouldn't be flagged in Google's detector. That's no longer a problem.

Read full article

Comments

© Aurich Lawson

  •  

AI/ML is becoming a performance factor in motorsport

There’s been something of a change in the world of motorsport over the past few years. It has to do with where the money comes from. In the old days, it was tobacco and, to a lesser extent, booze. Today such things are mostly banned, and when you look at a racecar covered in sponsor logos, you’re likely to see something crypto-, cyber-, or AI-related.

This makes sense—an ever-larger share of our GDP is wrapped up in those segments. They’re the ones with all the money, and it takes money to go racing. So at the amateur level, we’ve seen tech CEOs replace dentists as the privateer of choice: This past weekend’s Petit Le Mans included co-founders of GitHub, CrowdStrike, Shopify, and the creator of Ruby on Rails, to name a few.

But this is an instance where a sponsor can provide tangible benefits to their motorsports partner beyond a bank transfer, as Chip Ganassi Racing (CGR) and OpenAI have been showing in IndyCar this year.

Read full article

Comments

© Chip Ganassi Racing

  •  

Review: Fine, let's talk about Digger

I found the trailer for Digger intriguing, starring a nearly unrecognizable Tom Cruise and giving off strong Dr. Strangelove vibes. Plus, it is four-time Oscar-winning director Alejandro G. Iñárritu’s (Birdman) first English-language film since 2015’s The Revenant. Those elements quickly moved it near the top of my "must-see" list even if details about the actual plot were lacking. Given Iñárritu’s pedigree, the film seemed poised to be prime Oscar bait.

(Major spoilers appear below the gallery. We'll give you a heads-up when we get there.)

By now it's clear that Digger is on track to be one of the biggest bombs of the year instead, racking up a mere $20 million globally its opening weekend, against a $125 million (possibly more) budget. It has sharply polarized critics and audiences alike, with some appreciating Iñárritu's bold, creative swings and others finding the film practically unwatchable.

Read full article

Comments

© Warner Bros.

  •  

If you're looking, here's a "good deal" for NASA and the European Space Agency

It's no surprise that NASA's new tack toward foreign partnerships—good deals only, please—is challenging preconceived notions of international cooperation in space.

Without a massive budget hike, the US space agency's emphasis on building a Moon Base and winning a competition for lunar real estate and resources with China will inevitably leave lesser priorities behind.

Gone is the Lunar Gateway, a space station that was to be assembled in orbit around the Moon. For the United States, Gateway was an unnecessary distraction and expense as NASA goes all-in on placing a surface station near the Moon's south pole.

Read full article

Comments

© AEI/MM/Exozet

  •  

Drones sink ships near NATO countries in “unacceptable” attacks, EU says

Drones sank two cargo ships and damaged a third in the exclusive economic zones of NATO member countries for the first time, killing at least two sailors. The attacks represent a notable escalation as Black Sea commercial shipping has increasingly come under attack during the Russian invasion of Ukraine, with Russia also being accused of carrying out “hybrid warfare” incidents across Europe.

The Togo-flagged cargo ship Alfa Watan sank, and the Palau-flagged cargo ship Able was set ablaze after being attacked by multiple sea and aerial drones about 80 miles (128 kilometers) off the coast of Bulgaria on October 6, according to the Associated Press. In an interview, Bulgarian Prime Minister Rumen Radev described the incidents as “an unacceptable attack in Bulgaria’s exclusive economic zone” and “a blatant violation of international law and maritime law.”

A Bulgarian ferry managed to evacuate the 18 crew members of the Able, with two severely injured mariners being flown to a hospital in the city of Varna.

Read full article

Comments

© Iuliia Kuzmina / iStock Editorial / Getty Images

  •  

OpenAI will watermark ChatGPT outputs by default—but only in the EU

OpenAI will begin automatically watermarking text generated with ChatGPT in the European Union, the company has announced. It will also offer the watermarking feature in other regions, but it will be off by default outside of the EU.

The move in Europe is driven by a need to comply with the EU AI Act, which took effect in August. It requires marking content produced by AI models in a way that another tool can detect. Unfortunately, there is still no completely effective and reliable way to do that. A few standards already exist, like SynthID and the C2PA project, but they are relatively easy to circumvent for anyone with basic know-how.

The same is likely true for OpenAI's watermark. Its method is proprietary; the company calls it textGrain, and has published a technical paper explaining how it works. But in general, it works like other LLM watermarking tools we've seen in the past: It puts patterns in the word choices that are not clear to a human reader and that don't meaningfully change the general quality of the output, but that someone with a key can use a specialized detector to find. OpenAI says it will be giving access to the detector to a limited number of researchers and organizations and providing a request-for-approval process for others to be added over time.

Read full article

Comments

© Getty Images | NurPhoto

  •  

HBO Max, Paramount+, and Discovery+ "will unify into a single service”

After months of industry and customer speculation, Paramount Skydance has shed some light on the future of the HBO Max and Paramount+ streaming services.

Paramount Skydance completed its acquisition of Warner Bros. Discovery (WBD) today, ending a monthslong saga that began when Netflix last year announced its own plans to buy WBD. Netflix scrapped those plans in February. Skydance is the name of the company created from the $111 billion merger.

In an announcement today, Skydance said that all of the direct-to-consumer streaming services it owns, including the Discovery+ service that Discovery Inc. (which merged with WarnerMedia in 2022 to create WBD) launched in 2021, “will unify into a single service over time.”

Read full article

Comments

© Adam Gray/Getty Images

  •  

It looks like the Atlantic storm season may finally produce a hurricane

A low-pressure system in the western Gulf of Mexico should soon become a tropical storm, and based on the latest forecast modeling, it has a decent chance of becoming a hurricane.

Normally, a hurricane forming in early October would not be particularly noteworthy. However, this year the development of a hurricane would be a big deal—because it has not happened yet.

In the modern hurricane record—an era dating to about World War II when there has been aircraft reconnaissance and later continuous satellite coverage—there has never been an Atlantic season without a hurricane, and no season has gone this late without one forming.

Read full article

Comments

© Google Weather Lab

  •  

Hackers obtain counterfeit TLS certificates for Google and other large services

Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday.

The attackers launched a series of attacks on the .gh, .sl, and .as country code top-level domains (ccTLDs) and then modified authoritative DNS records for selected domains within those namespaces. By controlling those DNS records, the attackers were able to pass automated domain control validation checks and obtain unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.” Google said it updated Chrome to block all certificates it identified as unauthorized, and worked with the issuing certification authorities to ensure the unauthorized certificates for Google properties were revoked.

Certificate issuance: The weak link in the chain

TLS certificates are the cryptographic credentials that underpin authentication and encryption protections for websites, mail servers, and other Internet infrastructure. These x.509 certificates use a digital signature to bind a domain name such as google.com to a public key. The public key is publicly available, while the private key is held only by the website operator. When a connection shows that the keys match, the visiting party knows it’s connected to the authentic site rather than an impostor. Possession of unauthorized certificates allows attackers to cryptographically impersonate the affected infrastructure.

Read full article

Comments

© Getty Images

  •  

Paramount completes $111B Warner merger, creating “Skydance” behemoth

Paramount Skydance completed its $111 billion merger with Warner Bros. Discovery today, after a last-ditch effort to block the deal was rejected by Supreme Court Justice Elena Kagan.

The post-merger company is called Skydance, taking the name of a firm that Paramount bought in a separate deal last year. The new Skydance combines two of the largest movie studios, streaming services Paramount+ and HBO Max, CBS, CNN, "and a portfolio of live sports including CBS Sports and TNT Sports, as well as a deep programming library and expansive collection of brands and franchises," Skydance said today in a press release announcing completion of the deal.

The merger was delayed a bit by a lawsuit filed by California and 11 other states. In July, US District Judge Araceli Martínez-Olguín in the Northern District of California ruled that the combination would likely reduce competition substantially and violate antitrust laws.

Read full article

Comments

© Getty Images

  •  

Support Ars and get a better reading experience in return

When Ars launched in 1998, there was one way to read it: in a web browser on a PC (or Mac). Your screen of choice was either some massive CRT or a very expensive LCD monitor (or, in my case, the less-expensive grayscale, passive-matrix LCD on a PowerBook). Either way, it was butt in chair, chair at desk.

One of the first perks we offered subscribers way back at the turn of the millennium allowed them to read Ars without a browser. Articles were available as formatted PDF files, so you could print out John Siracusa's Mac OS X Public Beta review and read it on the subway or build your own searchable archive of your curated Ars content. Another option was full-text RSS feeds—instead of getting a two-paragraph summary, subscribers could browse Ars in their favorite RSS reader.

It's 2026, and while screens have proliferated in size and portability, ArsPro subscribers still get PDFs of every article and full-text RSS feeds, because sometimes the web isn't always the ideal place to read the web.

Read full article

Comments

© Aurich Lawson | Getty Images

  •  

Amazon kills Alexa’s ability to control Echo speakers' AUX input

Amazon has disabled Alexa control of devices plugged into the company's Echo smart speaker’s AUX port.

Users have reported receiving an email from Amazon this week informing them of the change. “This is a reminder that as of today, voice commands to control your Echo device’s Aux input are no longer available. Requests like 'Alexa, play from line in” or “Alexa, set aux input' will no longer work,” an email that Amazon sent reads, according to a screenshot a Reddit user shared this week.

An Amazon spokesperson confirmed the news to Ars Technica today.

Read full article

Comments

© Amazon

  •  

Neutrino physicist wins 2026 Nobel Physics Prize

Francis Halzen, a physicist at the University of Wisconsin, Madison, has won the 2026 Nobel Prize in Physics "for decisive contributions to the IceCube Neutrino Observatory and the discovery of high-energy neutrinos of astrophysical origin.” Halzen spearheaded the development and construction of the IceCube Neutrino Observatory in Antarctica, enabling physicists to capture high-energy neutrinos created in the distant universe.

“It was a great surprise, and I obviously didn’t expect it,” Halzen said during a news conference in Stockholm, Sweden, speaking by phone from Italy. While the Nobel was awarded to Halzen, he emphasized that his work was the result of a “large collaboration” with other researchers.

“This reflects on the really courageous people who joined me in this project when really no respectable conservative physicist would have joined me. But many talented people did, and that’s why I’m here,” he said.

Read full article

Comments

© IceCube/NSF

  •  

Googlebook "Better Together" phone features don't work with Samsung at launch

Googlebooks are Google's latest attempt to carve out a piece of the premium laptop market, and tight integration with Android phones is a key part of that effort. Now that Googlebooks are available, we're learning of some frustrating limitations of that plan. For now, Googlebooks will only play nicely with your phone if you have a Pixel.

When Google announced the launch window for Googlebooks, it said the laptops were "engineered to work with your Android phone right out of the box." But as with many things Google, the truth is more convoluted. We have since learned that you need Android 17 for any of the nifty integrations to work. With a compatible Android 17 phone, you can seamlessly stream apps to your laptop, access files on your phone, mirror notifications, and continue where you left off in certain apps when switching from phone to laptop.

You might think that the latest Samsung phones, which shipped with Android 17, would be ready for this experience. You'd be wrong, though. Some early Googlebook adopters have complained that phones like the Z Fold 8 won't work with the laptops. While the devices appear to see each other, the phone doesn't stay connected. Google representatives have since confirmed that these "Better Together" features are not currently supported on even the latest Samsung phones. An update that brings support to Samsung phones will roll out in "the coming weeks."

Read full article

Comments

© Google

  •  

FreshRSS 1.30.1

This is a security-oriented release with several security patches and bug fixes in the continuation of 1.30.0.

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

  • Some security attack scenarios patched
  • Fix domain-wide Retry-After
  • Fix muting of feeds gone with HTTP 410

Feature highlights✨:

  • CLI: Add optional feed argument to actualize-user.php

This release has been made by @Alkarex, @andris155, @fzlzjerry, @Inverle, @jamalkamaladdin, @jtracey, @Otolock and newcomers @akine, @colons, @ethanstoner, @gigioneggiando, @Juice-de-Orange, @pavel-miniutka, @qwist1233-cpu, @Sharawey74, @shcheglovnd, @TapuGithub, @yuchenshi, @ZainnQureshii

Full changelog:

  • Deployment
    • Reword recommendations and explanations for edge (rolling release) vs. latest (versioned release) channels #9270
  • Security
    • Config + increase default values for search max length and depth #9280
    • Accept a trusted proxy address given without a subnet #9301
    • Warn during session regenerate fail #9311, #9376
    • CI/CD add zizmor workflow for action security checks #9228, #9331
    • Use PHP #[\SensitiveParameter] #9322
    • Reject token access (RSS/OPML export, feed refresh) for disabled accounts #9336
    • Require POST+CSRF for self-update mutations #9335
    • Make the login challenge nonce one-time #9334
    • Bound ZIP import against decompression bombs #9332
    • Rotate session ID on all authenticated transitions #9333
    • Minz: Remove vulnerable and unused code path for displaying errors #9395
    • Fix NAT64 feed fetching on IPv6-only hosts #9372
  • Bug fixes
    • Fix domain-wide Retry-After #9390
    • Fix muting of feeds gone with HTTP 410 #9391
    • Fix infinite redirect loop due to SCRIPT_NAME in PATH_INFO #9282, #9287
    • Restore the automatic reading view after marking articles as read, while preserving explicit filters #9288
    • Fix adaptive reading state after marking articles read #9290
    • Fix regression sharing links #9303
    • Don’t disable anonymous refresh when anonymous feed access is disabled #9354
    • Fix regression with HTTPS proxies due to wrong TLS SNI resolution #9341
    • Better enforce limits for feeds and categories #9357
    • Fix JavaScript error when opening a label menu in sidebar #9377
    • Fix custom favicon with GReader API #9409
  • CLI
    • Add optional feed argument to actualize-user.php #9319
  • UI
  • Extensions
    • Call check_url_before_add hook when previewing a feed #9343
  • I18n
  • Misc.

  •  

FreshRSS 1.30.0

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.

Breaking change 💥:

  • Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights✨:

  • Filter global view feed list by state and search
  • New option to hide badges showing number of unread articles (Phantom Obligation)
  • Refresh only feeds in the current view
  • Offer to add a prefix when re-sharing user labels

Bug fixes highlights 🐛:

  • Several security attack scenarios patched
  • Fix lost elements while parsing search query
  • Fix “mark as read older than…” widening the active search
  • Fix saving user queries
  • Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

  • Security
    • 💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,
      #9195
      • Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
      • Passing * allows all networks like before (unsafe)
    • Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
    • Fix auth CSRFs (login and register actions) #9171
    • Log invalid challenge and ignore JSON error during login #9278
    • Disallow fetching of non remote URI #9215
    • Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
    • Fix access control in rss and opml actions #8912
    • Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
    • Cleaner limit anonymous mode to default user #9235
    • Fix HTML ingestions in templates #9146, #9170
    • Fix bad header filtering bypass #8964
    • Sanitize all fields during JSON import #9168
    • Gate greader (JSON) user query share format behind Share by OPML #9248
    • Public OPML should not contain cURL parameters #9070
    • Ignore security-relevant OPML attributes for dynamic OPML sources #9276
    • Strip feed URL credentials from anonymous user query output #9246
    • Set limits for regex during search #8913
    • Fix path disclosure in cache error message #9206
    • Limit the length and parentheses nesting depth of a search query #9277
    • Use timing-safe comparison for tokens #8945
    • Use hash_equals() for GReader API token comparison #9183
    • Mailer: allow disabling SMTPAutoTLS via config #9026
    • Warn during install if document root does not point to ./p/ #9010
    • Stop the unread-count poller after the session ends #9065
    • Add remote IP address to warning on form login #8942
    • Pin the GitHub actions using SHA #9200
    • Harden cache and SimplePie cache deserialization #9273
  • SimplePie
    • Security: Disallow javascript: URI scheme (protocol) #8263
    • Fix wrong player parent logic leading to invalid type #8893, simplepie#978
    • Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
    • Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
    • Fix sanitizer whitelist stripping order #9066
    • Show only one representation per media:group #9009
    • Bump upstream SimplePie #8947
  • Features
    • Filter global view feed list by state and search #9132
      • Use global view when searching from subscription page #9144
    • New option to hide badges showing number of unread articles (Phantom Obligation) #8844
    • Refresh only feeds in the current view #9060
    • Offer to add a prefix when resharing user labels #9236
    • Add log search to the logs page #9059
    • Add configurable log_level system setting #9185
    • New option to keep or not the custom sort order when navigating between categories and feeds #8969
    • New per-feed option to show or hide enclosures (attachments) #9015
    • Detect JSON feeds from URLs containing json #9058
      • Also when subscribing via the API #9167
    • Order categories during OPML import/export according to position #9203
    • OPML: include each feed’s refresh interval (TTL) in export/import #8982
    • Log failed CSS content retrieval (Web scraping) #9077
    • Allow providing a category when adding a feed by bookmarklet #9047
    • Add LinkAce sharing service #9024
    • Add Nextcloud Bookmarks sharing service #9032
  • Bug fixing
    • Fix lost elements while parsing search query #8884
    • Fix “mark as read older than…” widening the active search #9173
    • Fix saving user queries #9190
    • Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
    • Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
    • Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
    • PostgreSQL: make committing new entries resilient to duplicate keys #9231
    • Preserve negative timezone offsets in date intervals #9071
    • Fix feed dropdown bugs due to hash desync #8949
    • Fix slider not reinitializing after form submit #8973
    • Minz: Skip loading duplicated JS/CSS assets #9000
    • Respect simplepie_syslog_enabled for the uses cache logs #8986
    • Fix statistics repartition averages #8996
    • Fix article hover date visibility #8997
    • Keep search and state filters when marking articles as read #9007
    • Fix --db-prefix silently drops following CLI flags #9042
    • Remove stale dynamic favicon links #9127
    • Fix desync between favicon and title unread counters #9262
    • Fix outdated username length hint on registration and install forms #9013
    • Redirect away from wrong URL paths #9075
    • Fix auto-share shortcut on first use #9072
    • Exclude hidden feeds from global view counts #9152
    • Fix only the last <media:credit> being written to the RSS output #9174
  • CLI
    • New cli/reconfigure-user.php to read/write per-user config attributes #8873
    • Report new articles count per feed in app/actualize_script.php output #8948
    • Output a diagnostic when the cli/health.php check fails #8980
  • API
    • Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
    • Fever API: log the client IP address on authentication failure #8981
    • WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
  • Deployment
    • Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
    • Start supporting PHP 8.6+
      • Docker dev :newest with PHP 8.6 #9155
    • Docker: attach provenance and SBOM attestations to the published image #9150
    • Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
    • Fix .dockerignore being ignored during build in CI #9001
    • New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
    • Check GMP during 32-bit installation #9046
    • Improve actualize mutex to allow multiple instances #9045
    • OIDC: redirect to a default URL on expired auth state instead of 400 #9143
  • UI
    • Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
    • Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
    • Move disable button before remove button in user management #8944
    • Keep scroll position of slider after form submit #8974
    • Group export feeds by category #9079, #9154
    • Sort feed names with locale-aware collation #8985
    • Sort labels with locale-aware collation #9023
    • Format unread counter in title on page load #9263
    • Display slider after submit for all buttons in feed update UI #8999
    • Improve aside keyboard navigation #9202
    • Allows usage of Ctrl/Shift keys with the open website shortcut #9186
    • Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
    • Fix typo in alert error border color variable #9266
    • Use JavaScript Event() constructor instead of deprecated initEvent() #9035
    • Use :user-invalid instead of :invalid for CSS form field styling #9025
    • Remove unused simple layout #8998
    • Various UI and style improvements: #8823, #8824,
      #9140, #9145
  • Extensions
    • Minor Minz_Extension typing #8952
    • Improve extension list fetch diagnostics #9055
    • Fix a PHP warning in Serve action #9267
    • Fix extension settings cancel action #9053
    • Fix sharing menu conflicts with extensions #9074
    • Add read status hook for entries #8995
    • Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
    • Redirect after saving user CSS/JS so changes apply immediately #9006
  • I18n
  • Misc.

  •  
❌