Top stories
GitHub Actions Lockfiles Reach General Availability to Secure Workflow Dependencies
GitHub Actions lockfiles are now generally available, allowing workflows to pin direct and transitive dependencies to specific commit SHAs. This feature addresses a security weakness where mutable references like tags or branch names could be altered, potentially introducing malicious code into pipelines. The lockfiles ensure that the runner executes the exact commits recorded, enhancing supply chain security for GitHub Actions workflows.
Blender's UI Decoupled into Standalone Library BUI for Multi-Language Development
Blender's user interface has been decoupled into a standalone library called BUI, which provides Blender's UI widgets, interaction rules, and look as a reusable component. BUI features a small C core with bindings for Python, Rust, JavaScript/React, C++, and Dear ImGui, allowing developers to build applications with Blender's optimized UI without needing Blender installed.
CERT-In Warns of Hardcoded Credentials and Vulnerabilities in Tata Motors App
The Indian Computer Emergency Response Team (CERT-In) issued an alert regarding multiple vulnerabilities, including hardcoded credentials, in the Tata Motors app. These flaws could allow unauthorized access and information disclosure, posing risks to user data and system integrity.
Edera Launches Object Capability Bounded Authority to Isolate AI Agent Credentials
Edera introduced Object Capability Bounded Authority, a security model designed to isolate autonomous AI workloads and Model Context Protocol (MCP) servers from sensitive credentials. This technology enforces granular object capabilities at the hypervisor level, preventing AI agents from directly accessing API tokens, cloud keys, and administrative credentials, thereby mitigating risks from prompt injection and supply chain attacks.
Backdoor Found in Control Web Panel Server Allows Undetected Command Execution
Security researchers discovered a backdoor, named cwpdoor, hidden within the web server component of Control Web Panel (CWP), a Linux hosting management tool. This backdoor allows attackers to execute commands via web requests without leaving traces in access logs, indicating active exploitation in the wild.
Inkling 2 Small Mixture-of-Experts Model Released with Enhanced Agentic Capabilities
Inkling has released Inkling 2 Small, a 594B parameter Mixture-of-Experts model with 17B active parameters, supporting image inputs and variable effort. This new model shows improved performance in agentic coding, vision, knowledge work, and reasoning, surpassing previous Inkling models on the Artificial Analysis Intelligence Index with a score of 31. Inkling 2 Small is initially available through Tinker with closed weights, with plans for an Apache 2.0 open-source release after safety testing.
Mark Cuban Accuses Meta of Profiting from AI Deepfake Scam Ads
Mark Cuban claims Meta knowingly runs AI deepfake ads featuring his likeness promoting a fake diabetes cure, despite receiving complaints from victims. Internal Meta documents reportedly show the company anticipates billions in revenue from scam and prohibited product ads, with its platforms contributing to a third of successful U.S. scams.
NASA Announces X-70 Fractal Experimental Aircraft with Reconfigurable Flight Control
NASA announced the X-70 Fractal, a new experimental aircraft featuring reconfigurable flight-control technology and a modular design for interchangeable payloads. The aircraft is crewed, designed for Mach 0.75 cruise, and could fly within two years, marking a step in testing advanced flight technologies.
Claude Code Reportedly Exposes User Email Addresses in User-Agent Headers During Web Searches
A user reported that Claude Code is divulging their email address to third-party websites via the User-Agent request header during web searches without explicit permission. This privacy violation has led to an increase in scam emails for the user, prompting them to migrate their company's services.
NASA seeks commercial proposals to reboost or deorbit Hubble Space Telescope
NASA issued a Request For Information (RFI) to commercial companies for ideas to reboost, service, or safely deorbit the Hubble Space Telescope. Hubble is projected to re-enter Earth's atmosphere in the early-to-mid 2030s without intervention, and NASA is exploring options to extend its operational life or ensure controlled disposal. The RFI asks for capabilities to raise Hubble's orbit to at least 373 miles (600 km) or guide it to a controlled reentry by 2032.
Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing
A Brazilian labor court sanctioned two lawyers and fined their firms for embedding a hidden prompt-injection command in a court filing. The command, invisible in normal viewing, instructed an AI system to respond superficially and not challenge documents. This ruling is a global first in addressing intentional manipulation of a court's AI system.
Linux Kernel Module Unlocks Nvidia 3000 Series FP/BF16 Performance
A new Linux kernel module allows Nvidia 3000 series GPUs to achieve the FP/BF16 instruction issue rates of their professional equivalents. This module doubles the instruction issuing speed of FP/BF16 FMA into FP32 operations on GA102, GA103, GA104, and GA106 cards, significantly improving performance for matrix-heavy workloads like LLM prefill and diffusion.
DOJ Charges Five in Student Loan Fraud Scheme Using AI and Stolen Identities
The US Department of Justice has charged five individuals in a large-scale student loan fraud scheme that used AI and stolen identities to create "ghost students." This operation involved stealing millions in federal student aid by enrolling fake students and diverting leftover funds, leading to the seizure of over $750,000 in cryptocurrency.
Cloudflare Q3 2026 DDoS Report: Short-burst attacks surge, hyper-volumetric attacks decline
Cloudflare's Q3 2026 DDoS Threat Report indicates a 208% increase in short-burst, low-bandwidth attacks, while hyper-volumetric attacks over 1 Tbps decreased by 69%. Attackers shifted from CLDAP floods to DNS amplification and general UDP floods, which rose by 215% and 122% respectively. The United States became the most-attacked country, and targets broadened beyond media organizations to include consumer services, internet infrastructure, and adult entertainment.
Cisco Assigns Engineer to Rewrite 98% of Legacy Code Using AI Within 24 Months
Cisco's Chief Product Officer has tasked 27-year-old engineer Padmanabhan Krishnamurthy with refactoring 98% of the company's legacy code in two years, providing him with unlimited AI tokens. This initiative aims to modernize Cisco's codebase using AI-driven coding, reflecting a strategy to integrate younger talent and innovative approaches within the company.
Fujifilm to Increase Magnetic Tape Production Fivefold to Meet AI Data Storage Demand
Fujifilm plans to invest 10 billion yen ($63.3 million) to boost its magnetic tape production capacity by up to five times at its Odawara plant by fiscal year 2028. This expansion, the largest in 20 years, is driven by the increasing demand for long-term data storage in AI data centers, enabling the production of 100TB tapes. Magnetic tape offers a cost-effective and durable solution for storing large volumes of infrequently accessed data compared to SSDs and HDDs.
Rivian Plans to Integrate Third-Party AI Agents into its Vehicles
Rivian's CEO, RJ Scaringe, announced that the company plans to integrate AI agents from other companies like Anthropic into its electric vehicles. This initiative will allow Rivian cars to run advanced AI models beyond its current in-house assistant, expanding in-car functionality.
TeamViewer Vulnerability Allows Malicious Hosts to Execute Code on Technician Systems
A high-severity integer overflow vulnerability (CVE-2026-111585) in TeamViewer clients for Windows, macOS, Linux, and Android could allow a malicious host to execute arbitrary code on a support technician's machine. The flaw occurs when processing screen dimensions, potentially leading to buffer overflows and system compromise during a remote-control session.
GCHQ Cannot Account for Thousands of Data Storage Devices, Watchdog Reports
The British cyber and signals intelligence agency GCHQ cannot account for thousands of portable data storage devices, including USB sticks and external hard drives. The Investigatory Powers Commissioner's Office (IPCO) expressed concern over the agency's failure to determine the full scale of the problem, which has been known for several years. Some of these devices may contain sensitive data obtained under the Investigatory Powers Act.
Google Illegally Clears 250,000 Trees for Finland Datacenter, Halting Construction
Google illegally cleared 250,000 trees for a datacenter site in Muhos, Finland, without completing environmental impact assessments. The Finnish Licensing and Supervision Authority has ordered a temporary halt to construction at this site and another, sparking public anger and debate over Finland's role in AI infrastructure development.
University of Kentucky grants religious exemption for AI use based on humanist beliefs
A University of Kentucky research administrator received a Title VII religious accommodation to avoid mandatory AI use, citing his humanist belief in personal decision-making. This marks a precedent for humanism qualifying for such exemptions against AI in the workplace. The exemption requires deep moral conviction and cannot impose undue hardship on the employer.
Google Gemini Adds Direct File Generation and Editing for Docs, Sheets, and PDFs
Google Gemini now allows users to generate, preview, and edit various file types, including Google Docs, Sheets, and PDFs, directly within the chat interface. This update means users no longer need to leave the Gemini application to modify files created by the AI, expanding on previous capabilities that only allowed generation and download.
US Data Center Expansion Could Negate 15 Years of Greenhouse Gas Reductions by 2030
A Sierra Club analysis projects that the expansion of US data centers could lead to a 42% increase in carbon dioxide emissions from the US power sector by 2030 compared to 2025 levels. This increase, driven by new fossil fuel infrastructure to meet data center electricity demand, could negate 15 years of greenhouse gas reduction progress.
Instacart Reportedly Explored Sale to DoorDash and Uber
Instacart reportedly engaged in acquisition discussions with DoorDash and Uber, hiring an investment bank to evaluate its options. These talks suggest Instacart may be seeking to sell at a favorable valuation before increased competition in the grocery delivery market.
GitHub Adds 4M CPU Cores and 160 PB Storage to Handle 7.4B Monthly Commits
GitHub reported 7.4 billion commits in September, a significant increase from 2.9 billion in August, driven by 'agentic demand.' To manage this growth, GitHub added 4 million CPU cores, 160 petabytes of storage, and 50 Tb/s of network capacity, while also rearchitecting its platform to separate compute and storage.
FCC to Vote on Allowing Prisons to Jam Cellphone Signals
The FCC will vote on November 19th on rules to permit prisons to use radiofrequency jammers to block contraband cellphones. This move aims to prevent inmates from using phones for criminal activities, but raises concerns about potential unintended consequences and censorship of reports on prison conditions.
Nvidia Launches Nemotron 3.5 Transcribe, a Promptable Multilingual ASR Model
Nvidia released Nemotron 3.5 Transcribe, an open-weight, promptable multilingual transcription model. This model supports transcription in 40 languages, translation for 31 languages, and speaker attribution for 13 languages, handling recordings up to an hour long with up to eight speakers. It allows users to provide specific instructions and context, such as domain-specific terms or formatting preferences, before transcription, which can reduce error rates and simplify application development.
Amazon issues internal memo discouraging 'tokenmaxxing' in AI tool usage
Amazon released new internal guidelines for software engineers regarding AI tool usage, advising against "tokenmaxxing" or excessive AI use without regard for output. The company stated that metrics like token usage are "deeply flawed" for measuring AI's impact and emphasized focusing on long-term outcomes, reflecting a broader industry challenge with AI cost management and productivity measurement.
SK Hynix Seeks US Approval for China Chip Equipment in Exchange for US Fab
SK Hynix's Solidigm unit is reportedly seeking US government approval to export American chipmaking equipment to its Dalian, China factory. This approval is a condition for Solidigm to proceed with plans to build a NAND flash memory chip factory in the US, potentially in upstate New York. The Dalian facility produces 192-layer floating gate 3D NAND for data center SSDs.
ACLU Reports Police Use AI and ALPR Data to Flag Drivers for 'Suspicious' Travel
The American Civil Liberties Union (ACLU) reported on October 26 that law enforcement agencies are increasingly using AI algorithms and automated license plate reader (ALPR) data to identify and stop motorists based on "suspicious" travel patterns. This practice leads to traffic stops without initial evidence of wrongdoing, raising concerns about mass surveillance and an increase in pretextual stops. The ACLU warns that these AI-generated alerts could subject more innocent individuals to police encounters.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones and iPads
Apple released iOS 18.7.11 and iPadOS 18.7.11 to address a CoreGraphics zero-day vulnerability (CVE-2026-86950) that was actively exploited in targeted attacks. This update extends protection to older iPhone and iPad models, including iPhone XS and iPad 7th generation, which were not covered by initial patches released in September. The vulnerability, an out-of-bounds write, could lead to arbitrary code execution through maliciously crafted files.
Apple Addresses 329 Security Vulnerabilities Across System Updates
Apple released software updates for iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari, patching 329 unique security vulnerabilities. These updates resolve issues including unauthorized camera access, sensitive data exposure in Apple Intelligence and Siri, and multiple WebKit flaws allowing arbitrary code execution.
GPS Spoofing and Digital Scams Lead to Over $100 Million in Data Center Equipment Thefts
Thieves are using sophisticated digital tactics, including hacking freight broker accounts and GPS spoofing, to steal data center equipment worth over $100 million since June. These thefts involve manipulating shipping logistics and sometimes targeting off-duty police escorts, impacting the supply chain for critical tech infrastructure.
Ukraine Warns Hackers Exploiting Dahua Surveillance Cameras via Easy4IP Feature
Ukraine's CERT-UA has warned that hackers are gaining unauthorized access to Dahua surveillance cameras and video recorders, altering settings and creating unauthorized user accounts. Attackers are exploiting the Easy4IP remote access feature by guessing serial numbers and then using weak passwords or known firmware vulnerabilities to compromise devices. This poses a significant risk given the widespread use of these cameras in Ukraine, including by government and military entities.
OpenAI Donates Open Responses LLM API Specification to Agentic AI Foundation
OpenAI donated its Open Responses API specification to the Agentic AI Foundation (AAIF), a Linux Foundation project. This specification aims to standardize core API calls for large language models across different providers, reducing the need for developers to adapt to vendor-specific APIs.
Serbian Opposition Figures Targeted with Pegasus Spyware Ahead of Elections
The Citizen Lab confirmed that University of Belgrade Rector Vladan Đokić's phone was infected with Pegasus spyware, and prosecutor Rade Bajić also received an Apple threat notification, indicating targeting with commercial spyware. These incidents occurred ahead of national elections where former president Aleksandar Vučić is running for prime minister, raising concerns about the use of surveillance against political opponents.
Chinese National Extradited to US for Role in $37 Million Cryptocurrency Scam
Zhen Zhao, a 44-year-old Chinese national, was extradited from the Netherlands to California and arraigned for his alleged involvement in a cryptocurrency investment scam. The scheme defrauded 174 US victims of nearly $37 million by luring them into fake investment platforms and converting their funds into Tether (USDT) for transfer to Cambodia. Zhao is the ninth person charged in connection with this ongoing fraud investigation.
US Agencies Detail Incident Response Practices for Rogue AI Agents
NIST, NSA, and CISA released a report outlining ten key practices for preparing for and responding to unexpected or harmful behavior from AI agents. The guidelines, grouped into five stages, aim to help organizations manage risks associated with advanced AI systems.
MiniMax Releases M3.1 Flash AI Model, Claiming Significant Performance and Cost Improvements
MiniMax has officially launched its M3.1 Flash AI model, which was previously tested as "Space Bunny." The new model offers nearly three times faster online inference and a 70% reduction in usage costs, while improving performance in agentic tasks, coding, computer use, and cybersecurity.
UK to Invest £100M in New AI Biosecurity Lab, OpenAI and Anthropic Provide Credits
The UK government will invest £100 million to establish a national AI Biosecurity Lab (AIBL) to address biological threats and AI-enabled risks. OpenAI and Anthropic will support the initiative with £200 million in AI model credits. This aims to strengthen national defenses against evolving cyber, biological, and AI-enabled threats.