An anonymous reader quotes a report from 404 Media: In the immediate weeks before Muse's launch, Meta engineers found several security vulnerabilities in the company's viral AI agent product, at least one of which could have allowed malicious users to break outside of Muse's intended environment and access Meta's own sensitive databases and services, 404 Media has learned. The issues were so severe that they reached Mark Zuckerberg and staff worked overtime to fix them. These specific vulnerabilities were discovered before the launch of the product but required a multi-team "mad dash" to fix "a sudden spike in reported KVM escapes," according to an internal post by Meta executives to its core infrastructure team seen by 404 Media. In order for Muse to work, a user gives the AI agent access to various important services and accounts that they own. On Meta's end, each individual Muse instance runs on a kernel-based virtual machine, which connects to, but is supposed to be isolated from, Meta's own critical infrastructure. A "KVM escape," then, is when, through a security vulnerability, a Muse instance is able to escape from that virtual machine and interact with the system that runs it, or with other users' virtual machines. According to a Meta source, as well as internal security documentation and internal posts viewed by 404 Media, at least one of the vulnerabilities could have allowed an outside attacker -- that is, a normal Muse user -- to access data in sensitive internal Meta databases. At least one of the vulnerabilities was related to an exploit found in Linux kernel-based virtual machine code in July. 4 Several of the vulnerabilities were in the underlying Linux virtualization software that Meta uses for Muse. The security issue was considered serious enough that it was raised to Mark Zuckerberg, and several different security teams worked nights and weekends in the leadup to launch to fix the issues. [...] The Meta source said they felt security teams were asked to push hot fixes to these bugs as quickly as possible and in a way that wouldn't delay Muse's launch, leading to what they described as "half-baked protections being rushed out to enable the launch. Many senior engineers believe it's inevitable we're going to have a massive data breach as a result of Hatch." Muse is called "Hatch" internally and in Meta's codebase.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: Rendering Doom in a database is obviously a bad idea," Lukas Vogel writes in a lengthy blog post explaining how exactly he managed to render Doom using an SQL database. OK, that's not entirely accurate. The SQLDoom project uses a small Python client to handle input and output, drive the game's timing, and display each frame to the screen. Behind that, a series of CedarDB tables tracks the game geometry and state, while about 1,300 lines of SQL queries spread across 89 common table expressions implement the game logic and generate 35 bitmap framebuffers per second. In this, SQLDoom is a major improvement over Vogel's previous DoomQL project, which last year set out to build "a multiplayer Doom-like shooter entirely in SQL." Unfortunately, that effort ended up with raycasting-based, grayscale ASCII graphics that were more akin to the simplistic 90-degree-angled maps of Wolfenstein 3D. The newer SQLDoom, on the other hand, generates full-color 640x480 frames that look like they could have come from the original Doom executable. [...] If you want to run a Doomtabase on your own local machine, you can do so simply with the GitHub code, a copy of CedarDB, and a Doom WAD file. Or you can jump into a free online hosted demo match to test it out without all the setup [...].

Read more of this story at Slashdot.

"Rendering Doom in a database is obviously a bad idea," Lukas Vogel writes in a lengthy blog post explaining how exactly he managed to render Doom using an SQL database.

OK, that's not entirely accurate. The SQLDoom project uses a small Python client to handle input and output, drive the game's timing, and display each frame to the screen. Behind that, a series of CedarDB tables tracks the game geometry and state, while about 1,300 lines of SQL queries spread across 89 common table expressions implement the game logic and generate 35 bitmap framebuffers per second.

In this, SQLDoom is a major improvement over Vogel's previous DoomQL project, which last year set out to build "a multiplayer Doom-like shooter entirely in SQL." Unfortunately, that effort ended up with raycasting-based, grayscale ASCII graphics that were more akin to the simplistic 90-degree-angled maps of Wolfenstein 3D. The newer SQLDoom, on the other hand, generates full-color 640x480 frames that look like they could have come from the original Doom executable.

Read full article

Comments

© Lukas Vogel

The National Institute of Standards and Technology (NIST) is seeking industry and government input on how to modernize the National Vulnerability Database (NVD) as artificial intelligence increasingly changes the way organizations identify, assess, and remediate cybersecurity vulnerabilities.  NIST has issued a request for information (RFI) focused on the future of the NVD, asking stakeholders to weigh in on the technologies, processes and capabilities that could shape vulnerability management over the next five years. The agency is particularly interested in how AI can be incorporated while maintaining appropriate human oversight, transparency, security and data quality.  According to a notice published Wednesday in the Federal Register, NIST will accept comments on the RFI through Oct. 13, 2026.  The request comes as federal agencies and private-sector organizations assess how AI is affecting cybersecurity operations and vulnerability management. Those issues are also expected to be discussed at the 2026 FedCiv Summit on Oct. 29, where government and industry participants will examine AI adoption, cloud infrastructure, cybersecurity, and workforce enablement as part of broader federal civilian modernization efforts. 

National Vulnerability Database Modernization Comes as AI Reshapes Security 

The NIST NVD is a standards-based repository established and operated by NIST for the U.S. government. It has become a foundational resource for vulnerability management, software security, compliance automation, and cybersecurity risk analysis across both government and commercial environments. The NVD receives Common Vulnerabilities and Exposures (CVE) records through automated processes, generally ingesting new records within about an hour of publication. NIST analysts subsequently enrich the records with additional information, including severity scores and details about affected product versions. Users and cybersecurity tools can access that information through the NVD's web interface as well as automated mechanisms. The database therefore plays an important role in helping organizations understand publicly disclosed vulnerabilities and incorporate vulnerability information into security workflows. As AI-enabled security tools become more common, however, the way vulnerability information is collected, interpreted, prioritized, and acted upon is changing. NIST's RFI seeks to determine how the NVD can evolve to address those changes.

NIST Seeks Answers Across Seven National Vulnerability Database Areas 

NIST has organized the RFI around seven topic areas, allowing respondents to address any or all of the subjects. 

• Vulnerability Management Process: NIST seeks input on using automation to reduce bottlenecks while keeping human oversight for high-risk decisions. 
• Vulnerability Information Dissemination: NIST wants recommendations on tools, standards, and processes for securely and effectively sharing vulnerability data. 
• Risk Assessment and Prioritization: Stakeholders are asked how AI can improve risk-based vulnerability prioritization, transparency, and interoperability. 
• Remediation Development and Monitoring: NIST seeks guidance on standards and safeguards for developing, deploying, and monitoring AI-generated fixes. 
• NVD Data and Standards: The RFI focuses on improving vulnerability data quality, governance, and machine-readability for security tools. 
• Development Processes: NIST wants to explore how AI-enabled tools can be integrated into software development to identify and address vulnerabilities earlier. 
• Future Vision for the NVD: Stakeholders are asked to recommend capabilities, services, and performance metrics for the NVD over the next five years.