Billionaire, on SpaceX earnings call, says ‘special committees’ exploring idea but no agreement reached yet

As SpaceX released its second-ever public earnings report Tuesday, Elon Musk declared his support for combining the aerospace and AI company with his electric vehicle company, Tesla. He said both companies had created special committees to explore a potential merger, but have not reached any agreement on terms of a transaction.

“Both SpaceX and Tesla have formed special committees to discuss this idea at the request of shareholders and these special committees are, uh, consist of independent directors,” Musk said on the call. “Because I’m a conflicted party, I can’t actually be in the discussions of the special committees.”

Continue reading...

© Photograph: Steve Nesius/Reuters

© Photograph: Steve Nesius/Reuters

© Photograph: Steve Nesius/Reuters

Animation studio narrows annual loss to £1.1m amid ‘challenging market’ in children’s content

Don’t break out the celebratory Wensleydale just yet. Aardman, the British animation studio behind the cheese-loving inventor Wallace and his beloved dog Gromit, has fallen short of a target to get back in the black, its accounts show.

The employee-owned business was aiming to record a small profit in 2025 after two years of consecutive losses but was hit by production delays and a “challenging market” in children’s content.

Continue reading...

© Photograph: Ian West/PA

© Photograph: Ian West/PA

© Photograph: Ian West/PA

The wikipedia page for History of Knitting is illustrated with an "1855 sketch of a shepherd knitting while watching his flock" that buries the lede: he's wearing stilts and resting on a tripod seat high above his sheepdog and flock. I tracked the source to page 65 of Forrester's Pictorial Miscellany and along the way found a short documentary on the knitting shepherds of Les Bas Landes that has lots of photos of them on their stilts, especially Sylvain Dornon who stilt walked from Paris to Moscow in 58 days.

Questions raised over AI growth as ChatGPT maker forecasts this year’s revenue at $50bn, way below the $70bn signalled before

• Business live – latest updates

OpenAI has revealed that it is making about $20bn less in projected revenue than it had recently indicated to investors, raising questions about the break-neck growth rate in demand for AI.

The ChatGPT-maker company has told investors that its revenues for this year would reach $50bn (£37bn), a projection based on sales up to the end of September.

Continue reading...

© Photograph: Jeff Chiu/AP

© Photograph: Jeff Chiu/AP

© Photograph: Jeff Chiu/AP

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting Confluence Data Center and seven other self-managed products. The advisory, published on October 5, 2026, warns that every version of the affected software is exposed and urges administrators to act right away, either by upgrading or by putting temporary safeguards in place.  Beyond Confluence Data Center, the flaw reaches Bitbucket Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Atlassian is tracking the issue under BSERV-20604, CONFSERVER-104488, JSDSERVER-16809, JRASERVER-79546, BAM-26567, CWD-6610, CRUC-8741 and FE-7583. 

Which Atlassian Products CVE-2026-21589 Affects 

The bug lets an attacker with no login read specific files inside the web application's root directory. There is a catch for attackers: they must already know a file's exact name and location, since the weakness does not reveal or list directory contents. Even so, Atlassian notes that some setups may store sensitive files there, which raises the stakes.  Atlassian scores CVE-2026-21589 at 9.3, placing it in the Critical band, using the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. The company describes this as its own internal assessment and advises organizations to judge how it applies to their environments.  Cloud users are not affected. Atlassian says its Cloud products have already been patched, its investigation found no sign of exploitation there, and Cloud customers need to take no action. 

Patched Versions for Confluence and Other Atlassian Tools 

The primary fix is an upgrade. Atlassian recommends moving each installation to a fixed release, ideally the fixed LTS version or the newest available build. 

Product	Fixed versions
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Confluence Data Center	9.2.26, 10.2.19
Jira Service Management Data Center	5.12.40, 10.3.26, 11.3.12
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Bamboo Data Center	10.2.24, 12.1.12
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible	4.9.15
Fisheye	4.9.15

Stopgap Measures Against CVE-2026-21589 

Teams that cannot upgrade yet should take instances offline from the internet where possible, including those protected by user authentication. Atlassian then offers three mitigations, all built on one regex meant to block ".." sitting directly next to /, , or ::, including URL-encoded forms:  (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* 

1. Web Application Firewall rule (all products): block any URL matching the pattern in a WAF or proxy such as AWS WAF, Cloudflare or a reverse proxy, then test that encoded variants are caught. 
2. Tomcat RewriteValve (Confluence, JSM, Jira, Bamboo, Crowd): after a backup, shut down each node, enable the valve in server.xml (Crowd may use crowd.xml), and add or append a rewrite.config file in the product's WEB-INF directory. It checks both the normalized request path and the raw URI, returning a forbidden response. Restart the node afterward. 
3. urlrewrite.xml rule (Bitbucket only): back up, then place the rule at the top of /app/WEB-INF/urlrewrite.xml on every node, mirror and mirror farm node, returning a 404 via /mvc/error404. Restart Bitbucket. 

Checking Confluence Logs for Signs of Compromise 

Atlassian says it cannot confirm whether any customer instance has been hit and advises bringing in local security teams. Investigators can URL-decode each access-log request up to twice and search for ".." next to /, , or ::, or run the regex directly against raw log lines.  Under Atlassian's security bug fix policy, critical fixes are backported as new maintenance releases instead of binary patches. Customers can subscribe to alert emails at my.atlassian.com/email and raise questions through support.atlassian.com. 

Andrew Bailey tells chancellor ‘whatever the stance of fiscal policy, it must be credible and be seen as such by financial markets’

The Bank of England governor, Andrew Bailey, has urged the chancellor, John Healey, to agree a budget that reassures financial markets after the UK’s medium-term borrowing costs hit a fresh 19-year high.

With investors offloading government bonds previously considered safe havens amid fears of rising inflation, Bailey told all governments caught in the crosshairs of financial speculators that they needed to avoid market turmoil that raises the interest paid on debt.

Continue reading...

© Photograph: Andy Rain/EPA

© Photograph: Andy Rain/EPA

© Photograph: Andy Rain/EPA