The country’s gambling authority ordered ISPs to block access to the prediction market’s website.

The takeaway: Unveiling a long-term roadmap is often seen as a damage-control strategy when a game or franchise is underperforming commercially. Many would likely describe the Fallout franchise’s current position as healthy, with Fallout 76 continuing to receive frequent content updates and the TV series recently earning several Emmy nominations. However, announcing four new games with no confirmed release dates just weeks after significant layoffs could be viewed as a proof-of-life roadmap for the series.

Bethesda has confirmed that Fallout 5, remastered versions of Fallout 3 and Fallout: New Vegas, and a new Fallout title from Obsidian Entertainment are in various stages of development. Further details remain scarce, and at least some of these projects are likely years away, but Microsoft and Bethesda are aiming to reassure fans that more Fallout content is on the way despite thousands of job losses across the Xbox division.

The remasters have been rumored for some time and are expected to follow a similar approach to The Elder Scrolls IV: Oblivion Remastered, which enhanced the 2006 classic with Unreal Engine 5-powered visuals. Meanwhile, rumors about Obsidian’s new Fallout project emerged earlier this month.

– Bethesda Game Studios (@BethesdaStudios) July 17, 2026

Chris Avellone, director of 2010’s Fallout: New Vegas, which remains a fan favorite, is expected to helm the new project. In recent interviews with Bloomberg and Windows Central, Bethesda head Todd Howard said that his studio and Obsidian are collaborating on the game. The involvement of Fallout creator Tim Cain, who recently joined Obsidian, remains uncertain.

Howard also confirmed that Fallout 5 is in pre-production, but Bethesda is currently focused on The Elder Scrolls VI. The next Elder Scrolls entry is arguably the most anticipated game from any Microsoft-owned studio. The sequel to The Elder Scrolls V: Skyrim – one of the best-selling role-playing games of all time – was announced eight years ago and likely remains several years away.

Although it has not reached the popularity of Fallout or Elder Scrolls, Starfield will continue receiving new content this year. Bethesda also hinted at plans for the Fallout franchise’s 30th anniversary, which the company will celebrate in Washington, D.C., next year.

The announcements are among the first signs of new Xbox CEO Asha Sharma’s plan to refocus Microsoft’s gaming division around major franchises, including Fallout and The Elder Scrolls. Fans expressed concerns about the development of ongoing and future projects from Bethesda, Obsidian, and other Microsoft-owned studios after Sharma announced that the Redmond firm would eliminate 3,200 jobs this year.

While acknowledging the difficulties of losing employees, Howard noted that Bethesda has recovered from similar situations in the past. However, an anonymous developer involved with id Software’s Doom franchise, another series Sharma aims to promote, warned that the significant loss of talent could hurt future projects.

OS PLATFORMS

More a rewrite really, and of a very early version: Linux 0.11 – in Rust

Earlier this week, Linux project leader Linus Torvalds told AI haters to fork off, and invited anyone who didn’t like his comments to fork the kernel. Well, here you go: linux-0.11-rs, a total reimplementation of the Linux kernel, done in langage de programmation du jour, Rust.

No, this isn’t really a response to the Emperor Penguin’s challenge – for a start, it looks like it was done with AI – but the timing was irresistible.

The new project is by an undergrad student at Beihang University in Beijing, China, under the handle Poseidon.

Never mind not being a fork – Poseidon’s kernel isn’t even really a port of Linux. It’s a rewrite, and a rewrite of a very early version. It’s based on Linux kernel 0.11, whose source code you can peruse on this mirror.

This was an early kernel from December 8, 1991 – just a few months after the initial release, Linux 0.01. Version 0.11 was the last release of that first year of Linux. It was followed by version 0.12 in January 1992, then the version number jumped to 0.95 in March, as the young Torvalds started counting down to kernel 1.0 – which arrived two years later.

If you read the 0.11 release notice, Torvalds said: “Linux-0.11 has a few rather major improvements, but perhaps most notably, is the first kernel where some other people start making real contributions.”

He goes on to say: “This is a major milestone, since it makes the kernel much more powerful than Minix was at the time.” It’s also when “Ted Ts’o shows up as a coder.”

Poseidon’s Rust rewrite is quite a lot bigger than the original. The hackers of the “Orange Site” have been dissecting it with much greater expertise than this vulture can offer. User “dminik” fed it to an automatic code analyzer, and Pajecawav’s Ghloc reckoned that it’s just over 47,000 lines of Rust.

Dminik breaks that down: “It’s about 15k lines of code for the kernel and the rest is various utilities, libraries and programs that can run on the kernel.”

In other words, linux-0.11-rs is more complete than just the kernel. It also includes the core OS as it stood at the end of the year it first appeared.

“Poseidon” also credits a tutorial on writing an OS kernel in Rust, which implies to us that this was not an entirely bot-driven effort. Some work has gone into it. Some of the Hacker News commentators call it a waste of tokens, or more pointedly a waste of water and electricity, but it seems to be a kid having some fun, playing around and experimenting. For us, that’s a good thing. We hope that they found the exercise instructive.

The Reg FOSS desk is not a fan of bot-slop, but we do approve of exploring and learning and having fun. At least for as long as code-generating LLMs are cheap and plentiful, it will be very hard to prevent youngsters and students from playing around and experimenting with them.

Nobody is ever going to deploy anything on a bot-generated rewrite of a prototype kernel from 35 years ago – and don’t forget that the original was itself written by a 22-year-old who was doing it “Just for Fun.” ®

• US Air Force drone fires live missile during landmark autonomous aircraft test
• Human pilots remain in control despite growing drone autonomy capabilities
• YFQ-44A advances America’s plans for future robotic fighter operations

The US Air Force has successfully tested a Collaborative Combat Aircraft firing a live AIM-120 AMRAAM missile, marking a major step for autonomous combat systems.

The YFQ-44A drone, developed by Anduril Industries, launched the weapon against a digital target over the Mojave Desert during the historic test.

The Trump administration is now dictating which companies and entities get access to frontier AI models from Anthropic and OpenAI, CNBC reported on Friday, citing two people familiar with the matter. Until now, the labs made that decision themselves. Anthropic controlled access to its Mythos cybersecurity model through an initiative called Project Glasswing. OpenAI ran a similar programme called Daybreak for its cyber model. Going forward, these partner lists will require explicit government approval.

A White House official told CNBC that the government does not “provide approvals for AI releases” and that company participation is “voluntary.” But the administration blocked Anthropic’s Claude Mythos 5 and Fable 5 last month over national security concerns, reinstating access only after weeks of negotiations. OpenAI said in June it would limit new models to “trusted partners” to comply with government requests. The gap between the official position and the operational reality is the story. The White House launched Gold Eagle this week, an AI clearinghouse for cyber vulnerabilities, and according to CNBC’s source, the programme will put the White House in charge of greenlighting which companies can access new AI models.

The timing is politically uncomfortable. Moonshot AI’s Kimi K3 launched the same day and matched or exceeded Fable and GPT-5.6 on at least one independent benchmark. David Sacks, former White House AI czar, called it “concerning” and wrote: “This is how you lose the AI race. The rest of the world won’t play by our rules if we bog ourselves down.” The administration is trying to secure frontier AI against Chinese exploitation while simultaneously watching Chinese labs close the capability gap in real time.

The shift is structural, not temporary. Trump’s June executive order asked AI companies to give the government early access to models for testing, framed as voluntary. Gold Eagle operationalises that ask into something closer to a gating mechanism. If Anthropic and OpenAI cannot release their most capable models without government approval of the partner list, then the US government has acquired de facto distribution authority over frontier AI, without legislation, without a regulatory agency, and through a programme the White House insists is optional.

Despite significant external volatility, artificial intelligence continues to be a major driver of Ireland’s economy.

Ibec, the group representing Irish business, has today (16 July) published its latest Quarterly Economic Outlook report, which explores many of the issues impacting Ireland’s economy. 

It found that despite significant pressures and global volatility affecting growth, AI-related investment, investment in public infrastructure and resilient consumer spending are all continuing to support the economy.

Gerard Brady, Ibec chief economist and head of national policy, explained that we are seeing early evidence of the impact artificial intelligence is having on the country’s economic figures. He said that total trade in AI-related goods to and from Ireland is on track to double across five years, reaching €56bn annually. 

He explained that there has been a significant investment in ICT equipment and software, to the value of almost €6bn in the past year, which is a 50pc increase compared to 2025 and double the amount from 2024. He said that within business, the impact of AI on the competitive environment, investment, trade and the labour market is clear, that these figures will only grow over time.

Commenting on the report, Brady said, “Given that we are only at the foothills of understanding the impact of AI on our economy, the full picture has yet to emerge. We may not be at the forefront of developing new AI models, but early evidence suggests we have an opportunity to be a central node in AI-related supply chains. 

“We also have a massive opportunity to be the country with the best-prepared workforce for the generational change in work and skills currently underway. However, our participation in lifelong learning hovers around the EU average, well below where we want to be for an open, global and sophisticated economy.”

He explained that Ireland’s current economic success is firmly rooted in its commitment to investing in a manner that enables the country to be at the forefront of new technological shifts in the global economy. 

“We have a tangible opportunity to get ahead of other countries because we have a large training fund, in the form of the National Training Fund, paid for by employers, with a €2bn surplus. This cannot be left idle,” he said. “This fund must be deployed to support the workforce transition, prepare us for change and set Ireland up as a frontrunner in the emerging global economy.”

For Ireland, despite global pressures – such as the US-Iran ceasefire collapse, US tariffs and the uncertainty around the Strait of Hormuz – exports have remained relatively resilient. However, Ibec did find that it will be 2027 and beyond before we can fully understand the true impact of tariffs on Ireland’s exporting sectors. 

Brady said, “We expect exports, which grew by around 7.5pc in 2025, to rise only marginally in 2026 as a consequence of this ‘whiplash’ effect. However, exports are projected to resume strong growth at 4pc in 2027. The story within the domestic economy is more prosaic. Consumer spending is holding up, but inflation will dent its trajectory.

“While the labour market is showing signs of softening, investment remains strong. Most of the levers to support long-term economic development, such as infrastructure delivery, skills development, regulation, and supporting innovation and digitalisation, remain firmly within our control.”

Ibec also recently issued a new report exploring the correlation between workplace AI and consistent learning strategies. The ‘Skills for all, skills for life’ report warned that unless there is a deliberate shift in the national approach to lifelong learning, Ireland will fail to capitalise on the long-term economic potential of AI. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

But there’s something about a fully manual turntable from assembling and calibrating (and testing one’s patience) to cleaning a record every time you put a new one on. Convenient is not necessarily a word that I would use for this process. But it is a bit meditative. More importantly, the audio quality you get a step above with that analog warmth that the best turntables are known for, while not adding unnecessary distortion that may make your vinyl also sound a bit unintentionally lo-fi.

If there is a driving theme to The Java Story documentary, which debuted Friday on YouTube, it would be that even some of the most important and popular technologies come from humble beginnings. In this case, we’re talking about a language that started life as a failed attempt at set-top box dominance and required a massive rewrite just days before its big conference debut.

Today, Java consistently hovers near the top of the TIOBE programming language popularity index and remains widely used for large enterprise applications.

But at one point in 1994, Sun Microsystems was just about to abandon the effort. Tim Lindholm, who was hired to polish up a virtual machine runtime for what would become Java, told The Register, “I was one of the last people hired before the whole thing fell apart.”

It wouldn’t be the last time Java outlived its detractors. 

Java chronicled

If the idea of a professionally produced documentary about a programming language sounds familiar, then you’ve probably seen the ones on C++, Python or React. These were the work of tech job site Honeypot.io, which funded the documentaries to build a user base. 

In 2019, Honeypot was acquired by XING (which rebranded as New Work SE). However, founder Emma Tracey was more interested in the documentary side of things and bought the production shop back from New Work, reuniting the original gang and rebranding their efforts as Cult.Repo (short for Culture Repository). The Java Story is the first product of the newly liberated media company. 

The documentary features many of Java’s prime movers, including creator James Gosling and senior Oracle Java architects Mark Reinhold and Brian Goetz.

While it may have taken a Hollywood-style effort to construct a Hero’s Journey around the plodding progress of Python, Java is a veritable Love Island of dramas, some of which were this documentary captured. 

The project that almost wasn’t

Lindholm strayed into the computing field only as a result of the brutally cold winter of Minnesota, where he was living in a tent. He realized he would need someplace warmer and so scored an internship at Argonne National Laboratory in Illinois. There, he gained early experience with virtual machines thanks to the lab’s use of Prolog. 

His goal was not to be a programmer, but a mathematician. “Computer science was for people who couldn’t be real mathematicians,” he said.

But he learned the craft of implementing Prolog.

“I learned to write to very high-quality virtual machines with things like garbage collection and embeddability,” he said. The VM experience led him to subsequent jobs at Xerox PARC and eventually Sun.

When Lindholm arrived 1994, it was to work for an experimental “spin-in” subsidiary called FirstPerson. At the time, Sun made bank selling high-end workstations to engineers, but it wanted to build software for devices outside the typical workstation and PC market.

FirstPerson’s chief concern was a bid from Time Warner to provide the interactive video-on-demand software for television set top boxes. Gosling wrote a language and runtime for the project, called Oak.

The contract ultimately went to late bidder Silicon Graphics – a Sun rival commonly known as SGI. In a lesson of not always getting what you want, the Time Warner project struggled for a few years before the plug was pulled in 1997, which didn’t do the already-struggling SGI any financial favors.   

But at the time, Sun took the defeat hard, laying off most of the FirstPerson staff.  Lindholm had been there for only a month and wasn’t overly invested in the set top box. “I’ll do whatever comes next,” he recalled.

Sun kept only 12 engineers to work on Oak, including Gosling and project manager Kim Polese. But for Lindholm, the future didn’t look promising.

“We were like refugees in a bombed-out bunker,” he said. Those who were laid off tossed their office gear out into the hallways. Lindholm felt like “dead meat” at the Sun office, just waiting to get laid off himself. 

Pivot to the Web

It was purely serendipitous that the project moved to the then-nascent web. One of the surviving engineers had been playing with the recently released Mosaic browser and suggested the World Wide Web should be Oak’s next target. This was a year before Windows 95 brought the internet and web browsing to the masses.

The team built a Mosaic clone called WebRunner on Oak that would run animations. It would be the precursor to what would become Java applets. 

After that, events moved quickly, Lindholm recalled. Oak was renamed Java in early 1995, supposedly as a nod to the engineering team’s coffee consumption. “It took off like a friggin’ rocket. It was just crazy. We were all stressed,” he said. 

An early wave of web developers was rapidly discovering the limits of creating web pages using HTML, which, after all, is a markup language.

Lindholm said that his job, alongside , was

Gosling and the crew had assembled a rough prototype, but it fell to Lindholm, alongside fellow new hire and Lisp expert Frank Yellin “to make this thing actually work.”  The pair were in charge of the commercial grade implementation, ensuring that the advanced concepts Gosling had outlined, such as threading and garbage collection, functioned in the real world.  Lindholm and Yellin later co-authored the original JVM specification. 

Threading at the time was particularly new. There were no libraries they could use to implement the idea, and Lindholm knew relatively little about the concept.

The company planned to introduce Java at the 1995 SunWorld convention, the precursor to JavaOne. But the runtime was crashing badly. After much sleuthing, Lindholm figured out Java’s threading model was “fundamentally broken. It was totally screwed up,” he said. 

The problem was that system interrupts were being issued while the SPARC processor was executing an instruction. This proved disastrous because the system could not recover the state that had been flushed from memory and would therefore “die horribly.”

Lindholm realized you could only have the interrupts happen at certain points. So, three days before the conference, he rewrote the entire threads package. At the conference, when then Sun CEO Scott McNealy showed off Java, Lindholm sat in the audience dreading the worst. Thankfully, the rewrite worked.   

Before open source

Lindholm was also in charge of the language’s first attempt at open source, years before Eric Raymond made the term common. The company offered the binary Java runtime as a free download, but the company gave away “the sources,” as Lindholm put it, to anyone who requested it. Thousands did. 

The documentary retells a story that the Java Internet domain was getting so much traffic – more than Sun.com itself – that the Java team ran a pirate T3 line into the office. Such were the days before the cloud. 

At the time, Lindholm viewed giving away the source as a good career move. Should he ever get the ax, perhaps some other company would pick up the code and run with it. They also found outsiders could fix bugs and even extend the software to other platforms. 

The “source” program wasn’t formalized, however. Sun did have Richard Stallman come to talk, but he seemed “too radical” for the Sun execs, Lindholm recalled. Sun would not actually decide to officially release Java as open source for another decade. 

Ironically enough, Java applets were only modestly adopted for the web, as other technologies such as ColdFusion and Netscape’s JavaScript project ended up doing the heavy lifting for Web programmers. But applets were a gateway to the real action, namely powering the back-end servers. 

The evil empire

Then, Microsoft started paying attention. It saw the runtime as a potential threat to Windows itself, particularly for the fledgling Windows NT, which was starting to make headway into the enterprise. 

For today’s younger generation of IT pros, it is hard to overstate how aggressive and hyper-competent Microsoft could be at that time. In 1996, the company licensed Java for Windows, but then added some additional APIs and declined to support a few others (Anyone remember Microsoft’s J++?). Sun alleged that Microsoft’s changes were intended to undermine Java’s cross-platform compatibility and steer developers toward Microsoft’s Windows-specific implementation.

The years-long court case zapped the development team’s energy, diverting resources away from Java.

“I spent days in deposition talking about this under oath,” Lindholm recalled. The disputes ended with Microsoft paying Sun nearly $2 billion through a series of settlements. “It was personal for us,” he said. 

A wild ride

The documentary goes on to cover the following decades of the language’s growth through to the present day, including the over-engineered era of J2EE and Java EE 5, the glimmer of hope provided by the Spring framework, Sun’s implosion and subsequent acquisition by Oracle, and the flourishing of JVM languages following the release of OpenJDK.

Java continued to be a success for Sun, even as its chief business of selling SPARC-based Internet servers fizzled thanks to the influx of low-cost Linux x86 boxes. Lindholm noted that the Java team grew so large that it took over Sun’s headquarters and eventually had to move into the old Apple headquarters.

But Lindholm’s passion for Java evaporated by the early 2000s, swamped by the increasingly corporate environment, and so he left for Google, where he would spend the next 20 years until his retirement earlier this year. 

Looking back to his early involvement, Lindholm admitted “it was kind of a random thing. You can never tell what parts of your life will end up being really significant for whatever reason.”

Others agreed that Java has been a wild ride.

As Java creator James Gosling said in the doc, “What excites me most about the future is the unknown. Lots of things happen, and mostly the interesting ones are the ones you could never predict.” ®

Public exploits have been released for the critical “wp2shell” remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately.

The wp2shell attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.

The flaws were discovered by Adam Kues of Searchlight Cyber, which says an unauthenticated attacker can exploit them against a default WordPress installation.

“Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core,” explained Searchlight Cyber.

“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.”

Searchlight Cyber estimates that more than 500 million websites use WordPress, giving the vulnerability a potentially massive impact, especially now that public proof-of-concept exploits have been released.

Due to the severity of the vulnerabilities, the WordPress security team has enabled forced automatic security updates for supported installations running affected versions, urging site owners to update to WordPress 7.0.2 or 6.9.5 immediately.

“Because this is a security release, it is recommended that you update your sites immediately,” WordPress said in its security announcement.

“Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.”

The issue is not a single vulnerability but rather two independent flaws that can be combined into an unauthenticated remote code execution chain.

The first flaw, CVE-2026-63030, is a REST API batch-route confusion vulnerability introduced in WordPress 6.9. According to the GitHub advisory, the flaw can be combined with the SQL injection issue to achieve remote code execution.

The second vulnerability, CVE-2026-60137, is an SQL injection flaw in the ‘author__not_in‘ parameter of ‘WP_Query'. WordPress describes it as a high-severity SQL injection vulnerability affecting WordPress 6.8 and later.

According to the WordPress advisories, the complete RCE chain affects WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1.

The SQL injection vulnerability also affects WordPress 6.8.0 through 6.8.5, but cannot be chained to remote code execution because the REST API batch-route confusion bug was added in WordPress 6.9.

The full wp2shell attack chain has been fixed in WordPress 6.9.5 and 7.0.2.

Searchlight Cyber is currently withholding technical details to give administrators time to patch, instead creating the wp2shell.com website, which allows admins to test whether their WordPress installations are vulnerable.

For organizations unable to immediately update, Searchlight Cyber recommends:

• Installing a plugin that blocks anonymous access to the REST API entirely; or
• Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.

The company warns these mitigations should only be used as a temporary measure until systems can be updated.

Cloudflare also announced that it has deployed Web Application Firewall (WAF) protections for both vulnerabilities across all plans, including free accounts, that are proxied behind its platform.

According to Cloudflare, the rules block attempts to exploit both the SQL injection flaw (CVE-2026-60137) and the REST API batch-route confusion vulnerability (CVE-2026-63030).

“WAF protections reduce exposure while customers update, but they are not a substitute for patching,” Cloudflare said.

Public PoC exploits released

While Searchlight Cyber delayed releasing technical details to give administrators time to patch, multiple public proof-of-concept exploits have since been published on GitHub.

Some publicly available exploits combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to log in, upload a malicious plugin, and execute commands.

However, other proof-of-concept exploits claim to achieve pre-authentication remote code execution without requiring administrator credentials, which is more in line with Searchlight Cyber’s description of the flaws.

BleepingComputer has contacted Searchlight Cyber to confirm that its attack chain does not require an administrator password.

Security firm watchTowr says it has already seen in-the-wild exploitation after the public exploits were released.

“WordPress gets a bad rap for security. But the reality is that a highly impactful, unauthenticated SQL injection or remote code execution vulnerability in WordPress core is actually fairly rare,” watchTowr CEO Benjamin Harris told BleepingComputer via email.

“That is exactly what makes this one different, and why everyone is scrambling to patch before widespread exploitation takes hold. The watchTowr team is already seeing PoC exploits in circulation, and we are beginning to see the first signs of in-the-wild exploitation.”

Given the availability of public proof-of-concept exploits and the first reported signs of in-the-wild exploitation, administrators should ensure their sites are updated to WordPress 7.0.2 or 6.9.5 as soon as possible.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper