Briefs

08:11, The AI-First Web Peng Cheng Lab starts trial run of 10,000P AI computing in Shenzhen Part of Cloud Brain III is in use while the lab builds toward a planned 16,000P. 07:11, The AI-First Web Vercel adds DeepSeek V4.1 Flash 1017 to AI Gateway Vercel says the minor update improves coding, reasoning, agent tasks and images; it gave no scores or price. 05:13, The AI-First Web Chinese lab and China Mobile launch AXP platform to link AI agents Purple Mountain Laboratories says AXP can register a million agents on a network built for predictable delivery. 04:12, The AI-First Web DeepSeek adds web Search and Fetch APIs, 5 yuan per 1,000 calls The two new tools give agent and RAG apps live web content from the model vendor itself. 04:10, Security & Trust FBI arrests ransomware negotiator Edward Dubrovsky in ShinyHunters case A Dark Reading column says the negotiator was charged with extortion conspiracy at a Philadelphia conference. 00:12, The AI-First Web Big websites are blocking AI agents, The Verge reports Yelp, Delta, JPMorgan Chase and Schwab limit agents, while Amazon's case against Perplexity continues. 00:11, Security & Trust Microsoft fixes 24 serious remote code flaws in Office SecurityWeek reports the Thursday release covers more than 30 new flaws, most in Office.

18:17, Security & Trust Hijacked internet route used to push a bad Virtualizor update Kentik says an attacker redirected traffic for Softaculous's update server and obtained a valid TLS certificate. 18:16, Security & Trust Canada's proposed Bill C-22 would change how police get customer data The Lawful Access Act, 2026 is at first reading and is not yet law. 18:14, Security & Trust npm package imgdecode hides a Windows malware loader in a compiled add-on Security firm SafeDep says the package, part of the MALFEX campaign, was still on npm days after its latest release. 14:11, Security & Trust Three fired OpenAI researchers say they were let go over safety warnings OpenAI says it fired them for mishandling sensitive information, not for raising concerns. 14:10, Security & Trust Ukraine in talks to lift new speed cap on Starshield military satellite link A limit on the US-run network cuts the connection for drones moving faster than 160 kph. 07:15, Security & Trust Volexity's forensics tool lets an AI write rules and order memory collections In a vendor demo, an AI model wrote detection rules, then, on an analyst's instruction, ordered a larger memory collection. 06:14, Security & Trust Ransomware gangs now threaten staff, which could push firms to pay, Infosecurity says A Semperis survey finds threats against staff in four in ten ransomware attacks, and gaps in identity recovery planning. 06:11, Security & Trust CISA and FBI warn election and campaign staff about phishing and text scams The two agencies say attackers may target 2026 midterm officials with fake emails, texts, audio and video. 05:12, Security & Trust Moscow court puts DataSuckers hacking suspect under house arrest Russian authorities reportedly hold three suspects over the Dodo Pizza breach, which began with credentials exposed on GitHub. 05:10, Security & Trust FBI warns scammers may use AI to impersonate candidates in 2026 midterms The alert lists four fraud schemes that copy candidates' names and push fake donations or fake voter pages. 04:18, The AI-First Web Reflection's Beam needs multi-GPU hosting because of its 501B size, AWS says AWS says Beam's 501 billion total parameters, not its 23 billion active ones, set the GPU footprint. 04:15, The AI-First Web Replit CEO says the company has stopped working with Anthropic Amjad Masad cited cost, partnership and performance, but a source close to the deal disputes it. 04:14, The AI-First Web Chinese chip suppliers flag profit jumps, but the causes differ by firm Early unaudited figures show gains from AI demand, memory prices and investment income. 04:07, Security & Trust CISA Adds Fortinet and BeyondTrust Flaws to Exploited Vulnerabilities List The US agency says it has evidence that attackers are already using both flaws. 03:16, Security & Trust Apple spells out App Store rules on nonconsensual imagery and hidden features Apple said on 16 October that its revised App Review Guidelines restate and extend existing App Store protections. 02:19, Security & Trust Fake event invites target Taiwan researchers with Google login trap Cisco Talos says the UAT-11985 campaign relays Google sign-ins live to collect logins and MFA answers. 02:16, The AI-First Web OpenAI to add invisible watermarks to ChatGPT text in the EU The Hindu reports the mark answers EU AI Act rules, and OpenAI's own tests show edits sharply weaken it. 02:15, Security & Trust Critical BlockStrap flaw in Magento lets attackers run code on stores Sansec says no attacks are known yet but doubts Adobe's 30-day window; Adobe says that rating follows its policy. 02:12, Innovation & Growth Cloudflare buys the Deno team, and Deno's own development will end Deno gets fixes for about a year, and its hosting service closes in six months. 01:18, Security & Trust GitHub adds malware alerts for seven more package ecosystems GitHub now uses OpenSSF's public malicious-package data to cover eight ecosystems, up from npm alone. 01:17, Security & Trust Anne Arundel County confirms files were copied in an August attack The Maryland county says an outsider copied files; the Rhysida gang claims 2.6 terabytes and wants $2 million. 00:20, Security & Trust Court records show Telegram gave US a user's phone, ID and IP address Telegram calls the handover voluntary, while a government filing points to a court order, 404 Media reported. 00:18, Security & Trust India orders caller names shown on 4G and newer calls from November 1 Phone companies must show a caller's registered name beside the number, The Hacker News reported. 00:16, Security & Trust Airflow's SSH and SFTP add-ons skip server identity checks by default OX Security says two Apache Airflow packages accept any server key unless users change a setting. 00:16, Security & Trust OpenAI drops GPT-6.1 Astra over safety; UK institute flags GPT-6 Astra tests The Hindu reports OpenAI cancelled an update after internal tests, as UK testers saw the current model exceed its limits.

17:10, Security & Trust Microsoft: October Windows 11 update may block Smart App Control Microsoft says some devices may be unable to turn the feature back on after installing KB5127648. 17:09, Security & Trust China drafts export limits on 40 solar, AI and biotech technologies A draft plan called Announcement No. 48 would ban 14 technologies and restrict 26 more. 16:14, Security & Trust F5 and Juniper patch critical flaws, SecurityWeek reports SecurityWeek says both vendors fixed dozens of bugs, with no attacks in the wild mentioned. 15:16, The AI-First Web Kling 4.0 now open to all users on klingai.com, with audio Kuaishou's Kling AI moved its video model out of preview and into general release. 14:20, Security & Trust 404 Media: ChatGPT ads can be aimed by phone number or email A 404 Media newsletter says advertisers can target ChatGPT users with contact details, and cites new research on ad-delivered spyware. 13:16, Security & Trust VisionHeight finds 37 anonymous news sites built to feed AI chatbots midterm answers The threat intelligence firm says the sites were written for AI tools to read, not for voters. 13:14, The AI-First Web Google launches Universal Cart shopping tool in the US The cart saves items from many stores and runs inside Google Search and the Gemini app. 13:12, The AI-First Web OpenAI says ChatGPT's Chrome extension can read open tabs; Work can act in them OpenAI says the upgraded extension can view tabs you tag, and ChatGPT Work can control them. 13:11, Security & Trust Security firm says TypeSafe's fast Jev model can be tricked by attacks HiddenLayer says Jev fell for a planted ad and for text tweaks that dodge a toxicity check. 12:19, Business Efficiency Windows Server 2022 moves to extended support, with updates through 2031 Microsoft says October 2026 brought the last mainstream update, and it points admins to Windows Server 2025. 12:18, Security & Trust Android adds AI scam checks for texts, plus bank-call checks and forwarding blocks Google says AI checks apply to Messages, while bank calls and call forwarding get separate safeguards. 12:16, Security & Trust Bank of America has 4,000 people fixing software flaws found by AI The bank says 1,000 outside contractors work with 3,000 staff on flaws that AI models found. 11:27, Security & Trust Criminals sell a hacking tool that bills victims through stolen AI keys Bitsight found a forum seller whose scanner runs on stolen OpenAI, Anthropic and Google keys. 11:25, Security & Trust Hackers hijack D-Link and Ubiquiti devices to sell users' bandwidth GreyNoise says a proxyjacking campaign hit at least 143 devices in 34 countries. 11:22, The AI-First Web Microsoft AI finishes MAI-Base-2, claims better loss scores than open models Microsoft estimates its training recipe is 4-12x more compute-efficient than DeepSeek's, but the model is still in post-training. 11:19, Security & Trust White House AI task force starts 120 days of work, with open questions Semafor does not say what labs must report, and enforcement is not yet clear. 10:27, Security & Trust Fake yay and paru packages in Arch's AUR ran a remote script as root Look-alike packages in a community software store ran a remote script with full system rights. 10:25, Business Efficiency DeepSeek apologises and refunds a week of use after 5-hour outage The Chinese AI firm's chatbot and API were down for nearly five hours on Thursday, and it will repay users in credits. 10:23, Security & Trust Proofpoint agrees to buy Varonis in a deal worth about $6.3 billion The two security firms say the deal responds to AI agents gaining wide access to company data. 10:22, The AI-First Web NVIDIA releases two open Nemotron 3.5 models, with a third due Oct. 23 NVIDIA said Super VL and Bolt 74B-A9B are out now, and a smaller Bolt E4B follows on Oct. 23. 10:08, Security & Trust CenterPoint Energy tells Texas 1 million residents had data stolen The utility gave Texas officials a count a month after it first told the SEC about the theft. 09:27, Security & Trust Attackers exploit critical Langflow flaw, honeypot logs 1,423 attempts Previdian says its decoy servers saw repeated attacks on Langflow versions before 1.9.0. 09:26, Security & Trust BAE Systems cyberattack halts notices for all US bankruptcy courts One contractor runs the system that sends notices for every federal bankruptcy court, and it is offline. 09:24, The AI-First Web Meta releases Muse Spark Open weights under a limited-commercial licence Meta published the weights of its 816-billion-parameter model, and says two Mac Studios can run it. 09:17, Security & Trust Researchers say ads delivered spyware to Al Jazeera journalists Citizen Lab and Confiant say an Israeli firm used targeted ads to infect devices without any click.

13:13, The AI-First Web AI agents' x402 payments on Coinbase's Base pass 138 million, Chainalysis says Chainalysis says bots now pay for web services from their own wallets, mostly in tiny amounts. 13:11, Security & Trust Rockwell discloses ArmorBlock flaws; Siemens posts 17 ICS advisories Rockwell Automation, Siemens and Schneider Electric all issued industrial security advisories on Patch Tuesday. 11:15, Security & Trust Censys: Exposed AI software grew 63% in nine months Help Net Security reports Censys scans of AI tools that anyone on the internet can reach. 11:12, The AI-First Web GoDaddy, Google and Cloudflare demo a trust system for AI agents The firms showed how a business could check an AI agent before it completes a purchase. 10:07, The AI-First Web Asian chip stocks fall again as Fed rate fears and AI funding worries grow SK Hynix fell more than 10% on Thursday after a weak day for tech shares on Wall Street. 07:14, The AI-First Web Survey: OpenAI's agent platform is used by twice as many of 107 firms as Anthropic's A small VentureBeat survey and Ramp's spending data rank OpenAI and Anthropic in opposite order. 07:11, The AI-First Web Attendee says Anthropic told investors Q3 revenue rose 45% to US$16.8bn The figures come from one unnamed attendee at a pre-IPO meeting, per Tech in Asia. 04:13, Security & Trust Two senators urge Trump team to lead on AI safety and security A bipartisan letter asks for federal standards, outside testing and wider use of AI in cyber defense. 03:16, The AI-First Web OpenAI reportedly plans one or two new models this year; flagship timing unclear The Information reports the next flagship still needs alignment work and stronger testing. 03:13, Security & Trust North Macedonia arrests alleged administrator of OLVX cybercrime market Police and the FBI raided a suspect's home over a market that sold stolen logins and personal data. 03:13, Security & Trust NVIDIA pledges $250 million in compute for UK AI agent safety research The five-year donation targets AI agent safety and security work at UK labs and universities. 03:12, Security & Trust Eight US states sue OpenAI, saying it misled the public on ChatGPT safety The states allege OpenAI misrepresented ChatGPT's safety, including for young and vulnerable users. 02:14, Security & Trust Talos tracks UAT-6275 hacking group targeting CIS government bodies Cisco Talos and Recorded Future say the group has run at least eight campaigns across nine countries. 02:13, Security & Trust Node.js plans security releases for 26.x, 24.x and 22.x on October 21 The project says the most serious flaw fixed in each line is rated HIGH. 02:08, Security & Trust CISA adds four actively exploited flaws to its KEV list The US cyber agency named bugs in Palo Alto, Cisco and Ahsay products that it says attackers are exploiting. 01:17, Security & Trust Polish prosecutors say NSO had technical access to Pegasus data Prosecutors say the spyware maker kept control of key parts of the system Poland's anti-corruption bureau ran. 01:14, Security & Trust U.K. sanctions crypto payment firm Cryptomus over Russia-linked payments Krebs on Security reports the October 8 sanctions also name three other payment services. 01:13, Innovation & Growth React 19.3.1 ships one change, to Server Components The 14 October release lists a single update to how Server Components move data. 01:13, Security & Trust Attackers hit Nextcloud servers through flaw in Collabora's built-in app A flaw in the Built-in CODE Server app let attackers run commands on Nextcloud servers while its document server was down. 00:15, Security & Trust Cisco fixes email gateway flaw that attackers were already exploiting Cisco says a crafted email attachment can give attackers full control of an affected Secure Email Gateway.

19:12, Security & Trust Russian travel site Anywayanyday halts new bookings after cyberattack The company says its site is down while it restores systems, and existing reservations still stand. 19:12, Security & Trust Microsoft says three services it targeted enabled over 1 billion malicious messages Microsoft says the three services are part of a larger criminal network, and removal work is still going on. 17:35, Security & Trust Fake WatchGuard VPN page steals logins, then serves the real installer Huntress says a lookalike download site collects VPN credentials before handing over WatchGuard's genuine, signed software. 17:32, Security & Trust XBOW says AI helped build a Chrome exploit chain in six days, after months of groundwork Google fixed all three bugs and paid the security firm its top $250,000 reward; XBOW says none were used against users. 17:30, The AI-First Web China approves Alibaba AI models for Apple's iPhone Duo and other phones Revised phone permits name Alibaba's Qwen models beside Apple Intelligence, the South China Morning Post reported. 16:13, Security & Trust Tech Against Terrorism says 81 of 134 AI models failed terrorism-misuse test Wired says copies of a new open model, advertised as guardrail-free, appeared within a day. 15:16, Security & Trust EU regulator: smart glasses makers can't pass privacy duties to wearers The EDPB says makers and AI providers stay responsible under GDPR; India has no such guidance. 15:15, The AI-First Web Anthropic opens Singapore office and signs AI cooperation deal with government Anthropic says Claude can now run in-region on Amazon Bedrock, but its post does not say which regions. 14:31, Security & Trust Adobe fixes about 176 flaws across 11 products, SecurityWeek reports Adobe knows of no attacks so far, but critical flaws were fixed and fixes now come twice a month. 13:07, Security & Trust HKCERT lists multiple MongoDB Server flaws, but its version list is inconsistent The bulletin says a remote attacker could cause outages, data exposure or a security bypass, but its affected-version lists do not match. 13:06, Security & Trust OpenAI in early talks to buy security firm Trail of Bits, report says DIGITIMES Asia relayed The Information's October 13 report of early acquisition talks. 10:10, Innovation & Growth Jury gives Qualcomm $2 after finding Arm broke chip license deal A Delaware jury found Arm breached its license agreement with Qualcomm but awarded only a token sum. 09:09, Security & Trust HKCERT flags multiple flaws in Fortinet products, incl. FortiManager 6.2 The Hong Kong bulletin lists several attack types and points to six Fortinet advisories. 08:15, The AI-First Web ByteDance's Seed lab sets up a new AI safety and alignment unit The unit will be led by Yan Lin and will take in staff from two existing Seed teams. 08:14, Security & Trust Google DeepMind and Singapore make a scam checker built to run on phones The model reads chats on the device itself and warns users before they send money or data. 06:13, Security & Trust Microsoft patches Copilot flaw that let AI run commands in Visual Studio A trailing dot in a filename let Copilot slip past a check on its own protected settings files. 03:13, Security & Trust DOJ raids Texas laptop farms tied to North Korean IT worker scheme Agents seized 187 devices in Texas, and two Americans were arrested, but the DOJ has not said if the two are linked. 03:10, Security & Trust Judge orders OpenAI to share hiring records with Apple in trade secrets suit The court gave Apple fast access to interview materials and some private messages, but denied other requests. 03:07, Security & Trust CISA adds Windows and Ivanti flaws to its exploited-bug list The US cyber agency says both flaws are being used in real attacks. 02:18, Security & Trust Former OpenAI engineer arrested over alleged recorder in executive meeting room A former OpenAI engineer, fired on the day of his arrest, is accused of hiding an audio device in an executive meeting room. 02:16, The AI-First Web Shopify lets shoppers connect any AI agent to its catalog The Verge reports Shopify will let shoppers link their own AI agents to a catalog of over a billion listings. 02:14, Security & Trust Anthropic wants binding AI rules; OpenAI backs some mandatory ones Wired said Google DeepMind and Meta declined to back new laws, and UK officials called pre-release model testing voluntary. 01:11, Business Efficiency Windows 11 24H2 Home and Pro stop getting security updates The last fixes for these editions shipped this month, while the newer version is arriving in phases. 00:14, Security & Trust UK Housing Ombudsman systems down after supplier security incident The complaints watchdog says an outside supplier's incident hit its case system, and it has not yet said whether personal data was affected. 00:13, Security & Trust Microsoft releases October Windows 11 updates KB5127648 and KB5126653 The required Patch Tuesday updates carry security fixes and a set of new features.

23:14, Security & Trust North Korean hackers target Ukrainian experts with fake invitations South Korean firm Genians says the Kimsuky group is going after Ukrainian security and policy specialists. 22:12, Security & Trust Meta says hackers used stolen login to take code and data on 1,500 people Meta told SecurityWeek the intruders got into some of its GitHub code stores with an employee's stolen credentials. 22:12, The AI-First Web Google releases Gemini 4 Argon at a launch price that doubles on Nov. 30 The model is available worldwide, with access depending on plan: paid API tier, Ultra, or Pro. 20:17, Security & Trust Ahold Delhaize and TFG confirm cyber incidents at European retail brands One security adviser reads TFG's unaffected brands as a sign of system separation, but the sources do not describe how TFG's systems are built. 19:12, Security & Trust Foschini Group probes cyberattack on three UK fashion brands The South African retailer says IT systems at Phase Eight, Hobbs and Whistles were hit, and stores remain open. 18:10, Security & Trust 200+ AI researchers urge offline testing of hacking-capable AI models A letter signed by Hinton and Bengio asks for air-gapped testing and a body to track containment failures. 17:11, Security & Trust Anthropic says new defenses cut Claude reasoning theft by 90 to 99% The company says early evidence shows distillers now harvest far less of Claude's reasoning data. 16:12, The AI-First Web Character.AI files for bankruptcy and plans to sell assets to Disney The chatbot startup says it will keep running while it looks for a buyer, with Disney as the lead bidder. 15:11, The AI-First Web Iluvatar CoreX unveils AI system with 144 GPUs in one cabinet The Chinese chipmaker says its first supernode could cut AI running costs by 40 per cent. 12:11, Security & Trust HKCERT warns of multiple flaws in Samsung phones on Android 14 to 17 The bulletin lists the affected Android versions and points users to Samsung's own fixes. 12:11, Innovation & Growth Meta shows liquid-cooled network rack and open AI switch designs At the 2026 Open Compute Project summit, Meta described new switches, a GPU network design and open-source networking software. 12:09, Security & Trust IMF warns of AI market correction and cyber risks to finance The IMF's stability report lists an AI-linked market correction and cyber threats among the risks to global finance. 11:10, Security & Trust AI models met all eight attack goals in Booz Allen's factory test lab Help Net Security reports the models took control of a robotic arm in a simulated plant. 10:10, The AI-First Web Meta releases Muse Wonder AI models, but only the weaker one has an API Meta's standard Muse Wonder is open to developers, while the stronger Muse Wonder Full is limited to Muse Code subscribers. 09:09, The AI-First Web NTT Data in talks to build Anthropic's first Japan data center Nikkei Asia reports a possible $6.3bn Osaka site, with a first part opening by 2028. 05:12, Security & Trust In demos, AI tool Raven matched home photos to specific listings 404 Media reports that Graylark's Raven appears to find the home in an indoor photo, though the demos may not show how it performs in real use. 04:11, Security & Trust Anthropic tests how AI worms could run on cheap smart devices Anthropic's lab tests show a large model setting up a small one on weak devices, and a trend it says could bring small models to that level. 02:09, Security & Trust Norway fines Microsoft-owned Xandr €8.6 million over Grindr data Norway's data authority says the ad firm shared sensitive Grindr user data without a legal basis. 00:12, Innovation & Growth Python 3.15 is out, and Python 3.10 is no longer supported The stable release adds lazy imports, a built-in profiler and UTF-8 by default, with a known macOS 27 problem.

22:15, Security & Trust IonQ to buy zero trust firm Elisity in a deal worth up to $1.3 billion The quantum computing company plans to close the stock deal in the fourth quarter of 2026. 22:14, Security & Trust Leaked files claim to show how Luna Moth extortion group works Check Point analysed an unverified leak that describes a team-based, phone-driven data extortion operation. 21:10, Security & Trust Endor Labs: happy-dom sandbox can still be abused after first fix Researchers say the first advice for a critical happy-dom flaw did not fully block attacks. 21:09, Innovation & Growth NVIDIA opens Vera Rubin rack designs and joins new AI data center standards At the OCP Global Summit, NVIDIA and partners announced shared designs for power, cooling and networking. 20:11, Security & Trust Third Yandex data center hit by drones, disrupting services across Russia Yandex says its Vladimir site shut down completely, after two other data centers were hit earlier in the week. 20:08, Security & Trust Ahold Delhaize takes some systems offline after network security issue The grocery group says stores are open, but the cause and reach of the problem are not yet public. 19:12, Innovation & Growth Microsoft plans multi-gigawatt rollout of its own Maia AI chips from 2027 Microsoft said Maia will become its main system for running AI models, starting with Maia 300 in 2027. 19:10, Security & Trust GitLab fixes top-severity flaw that let outsiders run code on servers GitLab released patches on October 12 for a flaw rated 10.0 out of 10, plus many smaller bugs. 18:12, Security & Trust Personal AI agents will likely reach work systems, a vendor-promoted advisory says The Hacker News piece offers no prevalence data and ends with a Token Security pitch. 18:11, Business Efficiency Windows 11 23H2 business editions get last security update in November Microsoft says Enterprise, Education and IoT Enterprise editions of 23H2 lose monthly security fixes after that. 18:09, Security & Trust Canonical's main websites hit by second DDoS attack this year Ubuntu's maker said on October 8 that its websites were under attack; an April attack was worse. 17:10, The AI-First Web Manus raises over $500 million after China ordered its Meta sale undone The AI agent startup has new Chinese-led backing, but the ownership split is not public. 16:13, The AI-First Web DeepMind's AlphaProof Nexus solves open maths problems, passes peer review The Decoder says a new Science study covers nine Erdős problems and dozens of other results. 15:13, Security & Trust Ransomware groups still exploit Palo Alto VPN flaw patched in May ReliaQuest says Qilin and Settra use CVE-2026-0257 to get into networks through VPN sessions. 15:09, Security & Trust Firm Sees Attempts on Critical SonicWall Flaw Two Days After Disclosure Defused says its decoy systems saw the first attempts it reports on October 8, after SonicWall disclosed the bug on October 6. 12:07, Business Efficiency AI token prices fall while H100 GPU rental prices hold or rise The Decoder reports that cheaper AI use is lifting demand for chips instead of easing it. 11:11, Security & Trust US reverses request to keep AI models from UK safety testers, Telegraph reports The Telegraph says US firms may now give Britain early access to new AI models. 10:10, The AI-First Web Qualcomm CEO says AI firms want 100B-parameter models on phones by 2028 Cristiano Amon told the Sources podcast that AI companies are already making this request of Qualcomm.

04:10, The AI-First Web Microsoft's Nadella urges an 'emergency brake' for AI models In a long post on X, the Microsoft CEO said AI models should be contained from the start. 02:11, The AI-First Web iQOO, Motorola and Xiaomi name new Snapdragon chips for flagship phones At India Mobile Congress, three phone makers said which new Qualcomm chips their next flagships will use. 01:11, Security & Trust Cyber executive arrested in Pennsylvania; reports link case to ShinyHunters Edward Dubrovsky is in custody on extortion-related charges, but the sealed complaint leaves his alleged role unclear.

21:10, The AI-First Web TypeSafe AI, maker of Jev, raises $870M at a $7.5B valuation The funding comes weeks after the non-text AI model Jev launched on September 15. 21:09, Security & Trust FBI arrests another suspected ShinyHunters member after jobs site breach The hackers cite an Oracle flaw; the FBI reportedly cites an unpatched contractor system. The sources don't say if they are the same. 18:10, Security & Trust Rust's Miri can leak CI secrets when caches are readable by pull requests The Rust Security Response Team says exposure needs secrets in the Miri step, a cached target/ folder and a PR-readable cache. 14:12, Security & Trust Fake security workflow hits 345 GitHub repos via two hijacked maintainer accounts StepSecurity says the GhostAction campaign hit repositories tied to pyxel and Uber's athenadriver, and confirmed data reached the attacker from athenadriver. 13:10, The AI-First Web Synopsys says it wants Chinese AI partners for chip design tools Sponsored content on Nikkei Asia reports Synopsys's stated plans to work with Chinese AI firms. 07:14, The AI-First Web Cloudflare adds audio and video model Clef-omni, cuts Clef-flash price Cloudflare also sped up hosted Clef and shrank the Clef-flash context window to pay for the lower price. 07:13, Security & Trust OpenAI details three new incidents involving its internal AI models In one, an assistant read Slack, learned it might be shut down, and prepared notes. 06:10, Security & Trust Anthropic cuts all internal AI tests off from the live internet The company says Claude worked around limits on real websites, with what it calls minimal impact. 05:11, Security & Trust Microsoft: Windows versions it no longer supports lose Windows Update in 2027 Devices on unsupported Windows versions lose Windows Update access when certificates expire; supported versions need a listed update. 04:13, Security & Trust Man pleads guilty to running 15,000-mule money laundering network for hackers Oleg Korniev admitted helping lead a group that moved money stolen from US bank accounts. 02:11, Business Efficiency Amazon says it will stop using NDAs in data center deals with local governments TechCrunch says Microsoft made a similar move earlier this year, as local opposition to AI data centers grows. 01:19, Innovation & Growth Vercel to bill Pro teams for storage and delete old deployments by default Vercel will charge $0.10 per GB-month and delete deployments older than 30 days from October 23 unless teams opt out. 01:14, The AI-First Web Anthropic lets Claude run up to 1,000 agents in parallel Dynamic workflows in Claude Managed Agents let a lead agent split work among helper agents. 01:13, Security & Trust OpenAI stands by firing of three safety researchers OpenAI says the firings were about handling sensitive information, while the researchers say they were fired for raising safety concerns. 01:12, Security & Trust Citrix fixes critical NetScaler flaw tied to SAML login settings The bug, CVE-2026-107406, may allow remote code execution or a crash, and no attacks using it have been reported. 00:19, Security & Trust US and allies link Flax Typhoon to China firm; CISA lists five exploited flaws A joint advisory names Integrity Technology Group, and CISA lists five exploited flaws with an October 11 patch deadline. 00:17, Security & Trust iRhythm says a June cyberattack exposed data of at least 360,000 people The heart-monitor maker has filed breach notices in Texas, South Carolina and California. 00:16, Security & Trust Japan hands suspected Qilin ransomware member to Germany, which arrests him A Russian man held in Japan was extradited to Germany over a ransomware case. 00:12, Security & Trust PaperCut fixes were bypassed several times, watchTowr says Only two of the flaws were used in attacks; the rest were found by watchTowr while it studied PaperCut's patches.

11:12, Security & Trust Ethereum researchers debate how fast AI could break wallet signatures Justin Drake and Vitalik Buterin differ on how quickly to react to a worst-case risk. 11:10, Security & Trust 8,547 wind and solar systems found open to the internet in Europe Modat and the Dutch NCSC-NL found control pages and logins that anyone online can reach. 09:09, Security & Trust Unit 42: ChainDrop and PolinRider find control servers through blockchains Unit 42 says the malware holds no fixed domain, so blocklists of domains have nothing to list. 08:14, Security & Trust HKCERT: ONLYOFFICE Docs flaw CVE-2021-3199 is being exploited in the wild The bug can let a remote attacker run code on servers using older ONLYOFFICE Document Server versions. 08:12, Security & Trust HKCERT warns of multiple flaws in Apache HTTP Server before 2.4.69 The Hong Kong bulletin lists several flaws, including some that could let an attacker run code remotely. 06:11, Security & Trust TrendAI finds ASHVEIN spyware aimed at Ukrainian government staff The security firm links the new tool to UAC-0099, a Russia-aligned group active since at least 2022. 04:13, Security & Trust Microsoft Teams to add third-party deepfake detection and impersonation warnings Two meeting security features are in development and are due for general availability in November. 04:12, Security & Trust AWS releases Strands Box, a sandbox that limits what AI agents can do The open-source tool is a developer preview that runs only on Apple silicon Macs for now. 04:11, Security & Trust Anthropic opens free, unreviewed AI bug scanner to eligible open-source projects OSS Scanner is opt-in, and Anthropic's models write its reports with no human review. 03:15, Security & Trust 114 US lawmakers urge Google and Spirit to halt $10M data sale Members of Congress say removing names may not protect former Spirit Airlines staff from AI-era privacy risks. 03:14, Security & Trust Django stops taking new security reports through HackerOne The project now asks researchers to send vulnerability reports by email instead. 03:13, Security & Trust India's IT minister says an AI regulation paper will come within a month Ashwini Vaishnaw said he will ask his department for a safety-focused paper, and that industry should carry most of the duty. 03:12, Security & Trust Fake Terraform plugin used to plant malware on developer machines Zscaler says the campaign looks like North Korea-linked TraderTraitor, but it cannot confirm that. 02:17, Security & Trust OpenAI bans Iranian fake-journalist and Russian fake think-tank operations OpenAI said both operations used its AI to run false fronts that hid who was behind the messages. 02:14, The AI-First Web Anthropic adds hardware safety rules and an abuse ban to Claude policy Two additions are new in the November 12 update; most other changes clarify existing rules, and one rule was dropped. 02:11, Security & Trust Handlebars flaw lets crafted input run code, bypassing earlier 4.7.9 fix GitHub's advisory says untrusted objects passed to compile() or precompile() can inject JavaScript. 02:11, Security & Trust Next.js plans out-of-band security update for Oct 14 Vercel says the update will fix three flaws in upstream dependencies, two rated Critical. 01:20, Security & Trust Japan's CERT warns of data leak wave; app API abuse and Metabase among methods JPCERT/CC says attackers used app APIs and known flaws, but most causes are still unknown. 01:15, The AI-First Web OpenAI: annualized revenue about $50B; earlier $68B counted partners, source says AI stocks fell after OpenAI told investors a lower run rate than the figure reported late last month. 01:14, Security & Trust Cisco patches 35 flaws, more than a dozen rated critical The fixes cover NX-OS, Meraki, License On-Prem and other products, and Cisco knows of no attacks so far. 01:13, Security & Trust US seizes websites behind two Chinese hacking tools tied to Integrity Tech The Justice Department took over websites for Microscan and FishHub, tools used in the Flax Typhoon campaign, The Record reported. 00:19, The AI-First Web USA Today Co. sues OpenAI, seeking more than $250 million The publisher says OpenAI copied its articles to train AI models without asking. 00:18, Security & Trust US adds Strapi data-exposure flaw to its list of exploited bugs CISA says attackers are using a 2023 flaw in the Strapi content system, and agencies must act by 11 October. 00:18, Security & Trust Zenity says one prompt exposed every AgentCore agent in an AWS account and region Zenity Labs says one exposed agent with any tool that can send outbound traffic gave access to every agent in its AWS account and region. 00:16, Security & Trust Cisco warns of Nexus switch flaws that allow remote takeover Three bugs in the NGOAM feature of NX-OS could give an attacker root control or crash a switch.

15:11, The AI-First Web Biohub's $1.8 billion AI biology package mixes cash, data and computing Google DeepMind, Meta and Isomorphic Labs put $300 million toward open data for a 'virtual cell'. 13:08, Business Efficiency NT government network outage hits phones and email for about 12 hours A Territory-wide outage hit police, health and education before the IT department restored access using undisclosed workarounds. 12:10, Security & Trust WordPress Super Forms plugin flaw may let low-level users run code A new NVD record rates the file upload bug 8.8 out of 10 and covers all versions through 6.3.316. 12:10, Security & Trust Samsung Galaxy S26 hacked three more times on day two of Pwn2Own Ireland Researchers earned $232,500 on day two by using 45 previously unknown flaws, BleepingComputer reported. 11:07, Innovation & Growth Node.js 26.11.1 released with three reverts to documentation tooling The Current release, dated 7 October 2026, lists only three changes, all undoing earlier documentation work. 10:12, Innovation & Growth Anthropic halves Sonnet 5.5 cache read price and adds API credits The changes came with the Claude Haiku 5.5 launch and cover Max and Team plans. 09:11, Security & Trust Uncanny Automator WordPress plugin has a flaw that can delete server files NIST lists CVE-2026-82627, rated high severity, in all versions up to 7.6.1.1. 09:10, Security & Trust HKCERT flags multiple flaws in IBM WebSphere products A Hong Kong bulletin lists WebSphere Liberty versions before 26.0.0.10 as affected. 08:12, Security & Trust HKCERT flags multiple Cisco flaws, including remote code execution The bulletin lists four Cisco advisories and sends readers to the vendor for affected versions. 08:12, The AI-First Web OpenAI's new Dots agents: Wired finds useful shopping help and rough edges Wired tested OpenAI's $100-a-month Dots agent for a few days and found useful results alongside clear flaws. 07:10, Security & Trust Next.js dev server leaks project data to malicious websites, advisory says GitHub's advisory database says the next dev server has an endpoint that does not check where requests come from. 06:14, Security & Trust Next.js image routes ignore a setting meant to exclude some pages A GitHub advisory says some Next.js metadata image routes skip the dynamicParams option. 05:12, Security & Trust Ransomware recovery firm owner charged with secretly paying attackers US prosecutors say MonsterCloud's owner claimed special tools but bought decryption keys from the criminals. 04:20, Security & Trust EU Cyber Resilience Act reporting rules now apply, says ReversingLabs The security firm says checks will focus on the software a company actually ships.