The Morning Bro

The $111 billion price tag now includes CNN

Paramount's purchase of Warner Bros. Discovery (now $30.80, +10.8% 1D) had exactly one thing left standing in its way: an antitrust suit filed in July by a group of state attorneys general led by California's Rob Bonta. The reported ask was that Paramount sell CNN to get the deal cleared. On Monday the AGs settled instead — which means nothing has to be sold, and CNN conveys with the house.

Paramount: Eighteen months ago David Ellison was mostly known as the money behind quarter-zip dad movies — Jack Ryan: Shadow Recruit, Jack Reacher: Never Go Back, Transformers: Rise of the Beasts. A reallocation of his father's fortune later, he already runs CBS News and is now clear to add CNN, which would make him one of the largest news owners in American history. The promised fix for that is an “independent editorial board.”

The White House: In the same stretch of days, the administration defended in a court filing its decision to bar CNN, MS NOW and Politico from the building, saying the President determined they were in “violation of the standards of professionalism and decorum.” Decorum is not a standard you can measure, appeal, or lose on a technicality — which is the useful thing about it.

Zoom out: One $111 billion transaction puts CBS News and CNN under the same family, while three newsrooms spend the week arguing in federal court for a chair in a briefing room. Two of the three TV news desks you scroll past now answer to one phone number. You didn't vote on that and neither did anyone else.

The listings want fewer skills — and more years of having them

Data pulled from 75 million job postings shows tech roles now ask for fewer distinct skills and more experience at the same time. That sounds like a contradiction until you follow the gear: the software covers the tasks a junior used to grind through, so the skills list shrinks — but nobody wants to pay someone to supervise work they can't personally evaluate, so the years requirement goes up.

The junior role was the training program. It was badly paid, mostly grunt work, and it was how a 23-year-old turned into a 28-year-old you could actually trust with something. Automate that away and the posting still says “4+ years” — for a job that no longer exists at year zero. Employers are now paying up for experienced people because they stopped manufacturing any.

The bill doesn't arrive this quarter, which is why nobody's panicking. It arrives in about five years, when the senior bench is whoever happened to get hired before the ladder lost its bottom rung, and their salary is set by scarcity.

What does an AI boom look like from the jewelry counter?

Samsung Electronics, SK Hynix and the rest of Korea's tech complex powered a historic stock-market rally earlier this year. That rally doesn't stay on a screen — it converts into bonuses, dividend payouts and a plain wealth effect, and then it walks into a department store. Bank of America found Korean department-store sales track household equity investment with the relationship strongest at a lag of about a year, which means today's receipts are last year's stock chart, arriving late.

At Shinsegae, one of Korea's biggest high-end operators, August same-store sales rose +15% from a year earlier, luxury sales +20%, and revenue from international customers +82%. Richemont — Cartier, Van Cleef — posted Asia-Pacific sales +21% for the quarter ended June with Korea and Taiwan among its strongest markets. LVMH's Bernard Arnault singled out the “remarkable performance” of new Louis Vuitton stores in Seoul and Beijing.

Markets have since gotten choppy and Korean spending dipped in July before rebounding in September, but Morgan Stanley still raised its private consumption growth forecast for the year to 2.6% from 2.2%, citing stronger household incomes, rising wealth and inbound tourism. Big chipmaker bonuses are still to come, which is billions more with nowhere to be but the economy.

Attackers are exploiting the box that hands out access tokens. It handed them some.

F5 (now $450.10, +4.2% 1D)'s BIG-IP Access Policy Manager can be configured as an OAuth authorization server — the thing that issues the access tokens every connected app trusts. CVE-2026-94127 lets an attacker run code on that system without logging in first. Number of passwords required: zero. Own the token issuer and you don't need to break into the apps behind it; they'll open for you, politely, because the paperwork checks out.

F5: Disclosed in an advisory on September 22, already being exploited in the wild, engineering hotfixes released. It only bites systems where APM is doing OAuth duty — which is exactly the deployment sitting in front of the logins worth stealing.

Arista: A separate exploited zero-day in VCO that lets remote attackers reach privileged internal functionality. Arista's guidance is the least reassuring phrase in enterprise security: patch immediately.

Zoom out: Both products exist to be the hardened perimeter. Both were being used against their owners before a fix existed. If your bank, your employer's VPN, or your government login portal sits behind one of these, your entire security posture this week is “hope their IT team reads email.”

ROSENOW ROSENOW is how a model cracked Enigma by itself

Carter Leffer gave GPT-6 Astra one instruction — see if you can break any of the unbroken Enigma messages published on the Crypto Cellar Research page — and then got out of the way. No prompt chain, no human steering. It read the pile, decided message Nr. 172, MVUEH, was the most promising target, and suspected Nr. 173, SIPVX, was related to it.

Here's the gear it used, and it's the same one that beat Enigma the first time: a crib. You guess a chunk of plaintext you're confident is in there, then grind rotor settings until the machine spits your guess back out. Astra latched onto the repeated place name ROSENOW ROSENOW, wrote its own Enigma simulator and its own Bombe in Python and C++, ran the break, and landed the correct key and plaintext.

The decrypt is the least interesting part. Picking the target, inventing the attack, and building the tooling to execute it — that's three jobs that used to require a building full of people with security clearances. The researchers say they're still analysing the logs to work out exactly how it did it.

OpenAI is hiring mathematicians to tell it when it's wrong

A string of spectacular announced mathematical results turned into a reputational crisis, so on Monday OpenAI announced an independent panel of mathematicians to advise it — and other AI companies — on how they interact with mathematical research, including how new results get presented and released. Read that last clause again: the panel's job is the press release, not the math.

The failure mode was never the model. It was the release pipeline: announce the breakthrough, let the field check it afterward, discover in public that “breakthrough” was load-bearing. Mathematics has had a fix for that for a few centuries. It's called peer review, it happens before publication, and it costs approximately nothing.

The panel's arrival caught mathematicians by surprise, and researchers told The Verge it's a decent first step while noting they still have basic questions about what it will actually do. Which is roughly where you'd expect a group to be when it learns about its own mandate from an announcement.

Who's paying the guy ranting in your feed?

The old play was buying one influencer with a big following. The new play is paying an army of small creators to produce a blizzard of political videos — for a fraction of the cost of a traditional online campaign. The mechanism is the feed itself: ranking rewards engagement per post, not follower count, so a flood of small native-looking clips outperforms one polished ad and doesn't read as an ad at all.

That's the part that matters for you. A campaign ad announces itself — the music, the voiceover, the little disclaimer. A guy in a car talking to his phone doesn't. Same message, same invoice, none of the signals your brain uses to put up its guard.

It works across the spectrum, which is exactly why nobody's rushing to clean it up. The volume is the strategy: if a take shows up in fifty clips from fifty faces, it starts to feel like something everybody already thinks.

The algorithm knows your baby won't sleep. It has a $1,995 solution.

Ellen FitzGerald's nights ran on a loop: nurse for half an hour, hand him to Dad for another half hour of rocking, lower Rowan into the bassinet, watch him stiffen and start roaring — three or four times a night. To stay awake she scrolled, and that's the whole mechanism. Every 3am scroll is a signal, and a person searching “baby won't sleep” at 3am is the highest-intent buyer on the internet.

So the phone answered: a $179 course to teach your baby to sleep. A $1,995 smart baby bed to keep him asleep. A $289.99 monitor to track his breathing and chest movements while he does. That's north of $2,400 in one scroll session, and the FitzGeralds debated buying them in strained whispers in the dark more than once. “The algorithm completely clocks that,” she said.

The reason it works now is the gap it's selling into. Parents today are less likely to live near family, they're having kids later and fewer of them, and most American moms are back at work within weeks. Into that hole steps a $60 billion baby product market with one promise: buy the right object and you'll be the right parent. The FitzGeralds bought at least a dozen kinds of swaddle. Rowan, a baby Houdini, popped his arms out of every single one.

Twelve seconds: the whole arc of an Olympic gold medalist's UFC push

Signing a decorated amateur is a shortcut, and promotions love shortcuts. Building a draw normally takes fifteen fights and years of television; a gold medal arrives pre-built, with a story and a highlight package already attached. The catch is that the medal is a marketing asset, not a skill set — it doesn't transfer across sports, and the only thing that does transfer is the expectation. Gable Steveson's ended in 12 seconds at UFC 331.

Steveson has since responded both to the loss and to a 2019 allegation that was raised during fight week. Jon Jones, separately, took responsibility for his own Octagon exit — which is more accountability than these weeks usually produce.

Here's the money part nobody says into a microphone: the promotion gets paid for the attention either way. A 12-second finish is a clip, and clips are inventory. The fighter is the only one holding the tape afterward.

• Washington's planned arch will double as a storage site for military-grade weapons — the first monument with magazine capacity.
• Researchers hijacked cheap smart glasses over Bluetooth, exposing photos, videos and personal data. Your face camera has an audience.
• AWS is the first cloud cleared for NATO Restricted work in every member state — approved via Madrid, not NATO HQ.
• Coinbase will now lend you USDC against your bitcoin at a fixed rate. Degens have discovered the home equity loan.
• A designer built jeans out of 41 fully functional pockets, out-engineering every women's clothing brand on the planet.

1D / 1W / YTD = move vs prior close / 5 sessions ago / Jan 1. Pulled fresh.