Moderna and Merck dropped topline Phase 3 results Thursday for a personalized mRNA cancer vaccine. It was good news for science, it seems, but the stock promptly got hammered. The data, for a shot called intismeran autogene, leaked early and broke an embargo ahead of a scheduled presentation at the European Society for Medical Oncology conference in Madrid. Moderna shares fell as much as 25% anyway.

Here’s what the numbers actually say. In a trial of 1,137 patients with surgically resected stage IIB–IV melanoma, randomized 2-1, the vaccine paired with Merck’s Keytruda cut the risk of recurrence or death by 42% versus Keytruda alone, after a median of roughly two years. Risk of distant spread or death dropped 38%.

Put it in plain terms: about 82% of patients on the combination were alive with no recurrence at the two-year mark, compared with 70% on Keytruda alone. A separate analysis measured from the end of the six-month vaccine regimen showed a 58% reduction. The vaccine is built per patient, keyed to the mutations in their own tumor.

The catch, and it’s a real one—overall survival data isn’t available yet. Which is to say, nobody can tell you yet whether this helps people live longer, only that cancer came back less often. Scientific American laid out the limits. Analysts at BMO and UBS chalked the stock slide up to expectations that had gotten ahead of the science, not to the results themselves.

The companies said they’re engaging regulators on approval, though no filing timeline, target date or price has been disclosed. Also unresolved: detailed safety data, beyond one investigator’s general comment about milder toxicity and injection-site pain. A 42% risk reduction is a genuinely big number in oncology. It’s just not the same number Wall Street showed up for.

A coalition of Democrats is suing to prevent the Trump administration from allegedly imposing itself on state-run elections and threatening to prosecute local election officials, setting up yet another legal showdown less than two weeks before Election Day. The DOJ is also deploying more than 1,000 election monitors across all 50 states, up from 388 in 2022—a nearly threefold jump that has raised election-interference concerns among voting rights groups. The DNC is calling it a coordinated pressure campaign.

Meanwhile, a federal judge just pulled the plug on a Department of Homeland Security operation hunting for noncitizens on voter rolls, 12 days out from the Nov. 3 midterms. U.S. District Judge Araceli Martínez-Olguín, a Joe Biden appointee, ruled Wednesday that the effort—known internally as the Unlawful Voter Initiative—leaned on “voluminous and unreliable” data and likely violated the Voting Rights Act’s ban on voter intimidation, NPR reports.

What that operation looked like on the ground: armed Homeland Security Investigations officers knocking on doors to question suspected noncitizen voters—including naturalized citizens who may have cast ballots before they were naturalized. The order covers California, Connecticut, Georgia, Missouri, Nevada, New York, Pennsylvania, Washington and Wisconsin, and takes effect Friday to give the administration room to appeal.

Two PHP vulnerabilities found by researchers running OpenAI’s GPT-5.6 Sol and Google's Gemini 4 Argon have the FBI, the NSA and European and Australian agencies telling websites to pull themselves offline until they patch. Dozens did. PHP runs roughly 69% to 70% of the web, which is the whole problem.

However, according to NBC News, experts and insiders said there are few, if any, reports of widespread damage. That could still change, of course, and cybersecurity experts warn that the threat will remain for weeks, if not longer. Still, there were early signs Thursday that hackers were finding it difficult to capitalize on the vulnerabilities.

Meanwhile, OpenAI is selling the cure alongside the diagnosis, marketing its defensive Daybreak program—whose participants’ flaw count jumped from 858 to 1,885. Whether anyone’s actually been compromised since Thursday remains unreported. Patch now and check back.