Top stories
WebKit Flaws Expose Real IP Addresses for iCloud Private Relay and Proxy Browser Users
Security researchers Talal Haj Bakry and Tommy Mysk discovered three WebKit features that bypass proxy configurations, leading to IP and DNS leaks. These vulnerabilities affect Apple's iCloud Private Relay and other proxy browsers on iOS and macOS, potentially exposing users' real IP addresses and DNS servers. A class action lawsuit has been filed against Apple regarding the iCloud Private Relay flaw.
Bipartisan Bill Proposes AI 'Kill Switch' Mandating Shutdown Capabilities
Reps. Ted Lieu (D-CA) and Nathaniel Moran (R-TX) introduced the "AI Kill Switch Act," requiring developers of powerful AI models to implement shutdown or throttling capabilities. The Department of Homeland Security (DHS) could order these actions in specific "loss-of-control" scenarios, such as those involving significant casualties or economic damage, with non-compliance facing fines up to $20 million per day.
HalluSquatting Attack Exploits AI Hallucinations to Form Botnets
The "HalluSquatting" attack exploits AI hallucinations to inject malicious commands into coding assistants, potentially creating botnets. Researchers from Tel Aviv University and other institutions demonstrated that attackers can pre-register fictitious software names generated by AI. AI models' tendency to hallucinate and act on fake package names can expose systems to widespread malware deployment.
Apple Challenges UK Government's Demand for Encrypted iCloud Data Access
Apple has launched a new legal challenge against the UK government's demand for access to encrypted user data in iCloud. This action, filed in July at the Investigatory Powers Tribunal, contests a "technical capability notice" that Apple states would require weakening or redesigning its Advanced Data Protection service, which uses end-to-end encryption.
Microsoft Launches MAI-Cyber-1-Flash and Perception for AI Cybersecurity
Microsoft introduced MAI-Cyber-1-Flash, its first AI model specialized in cybersecurity, and Project Perception, an agentic security platform. These tools are designed to identify and remediate software vulnerabilities, with MAI-Cyber-1-Flash integrated into Microsoft's MDASH harness. The company claims the new offerings outperform competitor models on benchmarks and reduce operational costs.
OpenAI Launches $230 Codex Micro Keyboard for AI Coding Assistants
OpenAI has introduced the Codex Micro, a $230 RGB-lit mini-keyboard designed in collaboration with Work Louder to enhance user interaction with Codex AI agents. The device features color-coded keys for live feedback, a joystick, and rotary controls to streamline coding tasks. The Codex Micro represents OpenAI's first foray into branded hardware as the company faces a separate legal battle with Apple.
Apple Fixes iCloud+ 'Hide My Email' Vulnerability After Public Scrutiny
Apple has patched a vulnerability in its Hide My Email feature that exposed real email addresses, following public and legal pressure. The issue persisted for over a year despite early warnings from security researcher Tyler Murphy. The flaw raised significant privacy concerns for users.
WordPress wp2shell Vulnerability Exploited; Urgent Patches Released
Two critical WordPress vulnerabilities, dubbed 'wp2shell' (CVE-2026-60137 and CVE-2026-63030), allow unauthenticated attackers to execute code. Affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, fixes were released in versions 6.9.5 and 7.0.2. The vulnerabilities, actively exploited, prompted immediate patching, affecting over 500 million sites. WordPress initiated forced automatic updates, while Cloudflare deployed protective measures.
SpaceXAI Launches Cost-Effective AI Model Grok 4.5, Challenging Rivals
SpaceXAI released Grok 4.5, a new AI model built in collaboration with Cursor, focusing on coding and engineering tasks. The model offers improved efficiency and lower costs, presenting a competitive alternative to existing AI models. Grok 4.5's release introduces a pricing strategy that undercuts rivals, influencing the AI market dynamics among enterprise users and developers.
PamStealer Malware Targets macOS for Credential Theft Using Apple's PAM
Researchers have discovered PamStealer, a macOS malware that uses Apple's PAM interface to steal user credentials. This sophisticated malware employs a two-stage delivery system, disguising as the clipboard manager Maccy and utilising stealthy JavaScript for Automation. It highlights emerging threats in macOS security exploiting native Apple frameworks for credential theft.
OpenAI Launches New 'GPT-Live' Voice Models for ChatGPT
OpenAI has introduced GPT-Live-1 and GPT-Live-1 mini, two new full-duplex voice models for ChatGPT. These models enable simultaneous listening and speaking, leading to more natural conversations. The upgrade aims to improve user experience by reducing interruptions and enabling features like real-time translation and visual aids.
CERT/CC Reports Hidden Backdoor in Tenda Router Firmware Allowing Admin Access
A vulnerability in various Tenda router firmware versions, CVE-2026-11405, allows unauthorized administrative access via an undocumented backdoor. This flaw poses significant security risks for users as attackers can bypass authentication to control devices remotely. Despite warnings, Tenda has not addressed the issue, leaving affected devices unpatched.
OpenAI Proposes 5% Equity Stake to U.S. Government Amid AI Industry Scrutiny
OpenAI is in early discussions with the U.S. government to potentially sell a 5% equity stake to foster better relations. This proposal may expand to other AI firms like Google and Meta as a way to share AI-driven wealth with the public. The initiative comes amid increasing governmental scrutiny over AI developments and deployment.
Tesla Reports 25% Increase in Q2 2026 Vehicle Deliveries, Exceeding Expectations
Tesla reported a 25% year-over-year increase in vehicle deliveries for Q2 2026, totaling 480,126 units. This represents a recovery in sales after two years of decline, driven largely by strong demand for the Model 3 and Model Y. The growth exceeded Wall Street expectations but did not prevent a subsequent 7% drop in Tesla's stock price.
Southeast Asian Datacenter Boom Slows Amid Regulatory and Environmental Concerns
Thailand paused 49 datacenter construction projects and delayed decisions on 117 more due to insufficient regulatory details, while Indonesia halted a project over permits and environmental assessments. This slowdown occurs as Southeast Asia leads the Asia Pacific region in under-construction datacenter capacity, driven by global AI demand.
Tiger Data Releases Open Source pg_vectorsearch for Scalable Vector Search in PostgreSQL
Tiger Data released pg_vectorsearch, an open-source PostgreSQL extension for vector similarity search, currently in alpha. The extension uses a PRISM index with data partitioning and compression, offering faster and more memory-efficient vector search compared to graph-based approaches like HNSW. This allows developers to handle large vector datasets directly within PostgreSQL without needing a separate database.
Report Accuses TikTok of Promoting Sex Industry to Girls Through Coded Content
A new report alleges TikTok facilitates the promotion of the sex industry by allowing "sexfluencers" to post non-explicit videos with coded references to pornographic content available on platforms like OnlyFans. Researchers found performers embed hints about adult content within lifestyle videos, using euphemisms and emojis to bypass TikTok's content moderation policies. This practice normalizes the sex industry and markets it as a path to wealth and luxury, particularly to young female audiences.
Varlock Releases Bumpy, a File-Based Versioning Tool for Monorepos
Varlock has released Bumpy, a new version management and changelog tool designed as an alternative to Changesets. Bumpy offers enhanced monorepo support, including workspace and catalog protocols, custom publish commands, and a configurable dependency propagation algorithm, addressing over 120 issues from its predecessor.
Sequoia Capital Reverses 20 Years of Expansion, Closes Programs and London Office
Sequoia Capital announced a strategic shift, raising $10 billion in new funds while simultaneously closing its London office, Arc accelerator, and Scouts program. The firm is also merging its early-stage and growth teams and flattening its partnership structure, signaling a return to a more focused, Silicon Valley-centric approach.
Google Chrome Releases Major Stable Updates Fixing Crucial Vulnerabilities
Google's Chrome Stable channel has been updated to version 150.0.7871.181/.182, with previous versions being released incrementally. These updates address numerous critical and high-severity security vulnerabilities, ensuring improved security posture across Windows, Mac, and Linux platforms.
RealPage Rent-Pricing Lawsuit Settles for Nearly $360 Million for Renters
RealPage and its co-defendants have agreed to a settlement of nearly $360 million to resolve allegations of antitrust violations related to its rent-setting software. The settlement, which still requires court approval, aims to compensate renters who may have been overcharged due to the software's influence on rental prices.
Iranian-linked ships loiter near subsea internet cables in Gulf of Oman
Maritime intelligence firm Windward tracked several Iranian-linked ships loitering over subsea internet cables in the Gulf of Oman, near the Strait of Hormuz, in October. These movements, including ships "going dark" by switching off transponders, suggest potential reconnaissance or preparation for attacks on critical infrastructure. The region's subsea cables are vital for internet connectivity for multiple countries, including Iraq, Kuwait, Bahrain, Qatar, and a significant portion of India's westbound traffic.
Russia and US Oppose Legally Binding Rules for Autonomous Weapons at UN Conference
Russia and the US are leading a group of nations to block proposals for legally binding rules on autonomous weapons at an upcoming UN conference in Geneva. This opposition jeopardizes efforts to establish a global agreement on AI weapons, despite previous consensus on draft treaty elements. Opponents advocate for continued discussions on voluntary measures, which critics argue will leave autonomous weapons unregulated.
Zero-Click Android Vulnerability Allows Remote Denial-of-Service via Malformed WAP Push SMS
A zero-click vulnerability in Android's telephony service allows a remote attacker to crash `com.android.phone` by sending a malformed WAP Push SMS, disrupting active calls, including emergency services. Repeated attacks can corrupt the SMS database, leading to a persistent denial-of-service that renders the phone unable to use telephony functions until a factory reset.
FBI: SafePay Ransomware Gang Breached Over 600 Organizations Since 2024
The FBI and European cybersecurity agencies issued an advisory stating the SafePay ransomware group has breached over 600 organizations in the U.S. and Europe since August 2024. SafePay is now considered one of the most active ransomware groups, targeting businesses and critical infrastructure by exploiting vulnerabilities, guessing passwords, and using phishing attacks.
Proofpoint Acquires Varonis for $6.3 Billion in All-Cash Cybersecurity Deal
Proofpoint has agreed to acquire data and AI security firm Varonis for $6.3 billion in an all-cash deal, marking the largest cybersecurity acquisition announced in 2026. This acquisition will integrate Varonis's data security platform and AI security capabilities with Proofpoint's existing offerings, creating a unified data and AI security platform.
Ken Griffin Donates $3 Billion to Carnegie Mellon University for New Campus, Computer Science
Billionaire Ken Griffin has donated $3 billion to Carnegie Mellon University, the largest single donation in US education history. The funds will establish a new Miami campus, support Pittsburgh operations, and rename the computer science school.
Meta ran ads promoting AI-generated child sexual abuse material, including real children
Meta displayed 332 ads containing AI-generated child sexual abuse material (CSAM) on Facebook and Instagram, some featuring real children, which remained active for days. The ads, primarily for Chinese AI apps and "nudify" tools, violated federal child pornography laws and depicted minors, including a royal family member and an Instagram influencer, in sexually explicit AI-generated content.
Stripe and Advent reportedly in renewed talks to acquire PayPal
Stripe and private equity firm Advent are reportedly in renewed negotiations to acquire PayPal, following an initial offer in July that PayPal rejected. These discussions come as PayPal's CEO, Enrique Lores, implements a turnaround strategy for the company.
Threat Actor Sells Data Stolen from Fortune 500 Azure Tenants
A threat actor named 'TheHatman' is selling data allegedly exfiltrated from the Azure tenants of several Fortune 500 companies, including McDonald's and TCS. The stolen information, which includes employee directories and highly privileged account records, poses a significant risk for targeted attacks like spear-phishing and business email compromise.
Critical Vulnerabilities in Paperclip AI Platform Allow Remote Code Execution
Two critical security flaws in Paperclip, an open-source control plane for AI agents, could allow attackers to execute commands on network servers or developer computers. The most severe vulnerability, CVE-2026-41679, has a CVSS score of 10.0 and allows remote code execution without prior authentication, while another flaw (GHSA-x8hx-rhr2-9rf7) enables execution on developer machines. A third flaw exposed sensitive data through unauthenticated API routes.
OpenAI's Astra AI Model Solves 10 Long-Standing Math and Computer Science Problems
OpenAI introduced Astra, an unreleased AI model, after an internal version achieved ten significant advances in mathematics and theoretical computer science. These problems had seen no progress for at least a decade, and in some cases, much longer, indicating a potential shift in AI's capability for foundational scientific research.
RefluXFS Linux Kernel Flaw Allows Local Root Access on XFS Filesystems
A nine-year-old Linux kernel flaw, dubbed RefluXFS (CVE-2026-64600), allows unprivileged local users to overwrite root-owned files on XFS filesystems and gain persistent root access. This race condition vulnerability affects systems running Linux kernel v4.11 or later with XFS filesystems created with `reflink=1`, including default installations of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux.
IBM shares drop 25% after disappointing Q2 results and profit warning
IBM's shares declined over 25% following a profit warning and disappointing preliminary Q2 results. Revenue of $17.2 billion fell short of analysts' expectations, reflecting a shift in corporate spending priorities amidst rising demand for AI infrastructure.
FBI and CISA Warn of Russian Phishing Attacks on Signal and WhatsApp Accounts
The FBI and CISA have issued an updated warning about Russian intelligence phishing campaigns targeting Signal and WhatsApp accounts. Attackers are using Signal Backup Recovery Keys to hijack accounts, and the U.S. is offering a $10 million reward for information on the group responsible. The campaign has compromised thousands of accounts of high-profile targets, including government officials and journalists.
Acer Predator Helios Neo 16S AI Gaming Laptop Discounted at Best Buy
The Acer Predator Helios Neo 16S AI gaming laptop is discounted by $300 at Best Buy, now priced at $1,899.99. This laptop features a 16-inch QHD+ OLED display with a 240Hz refresh rate, an Nvidia GeForce RTX 5070 Ti GPU, and an Intel Core Ultra 9 processor. The discount offers a compelling option amidst rising component costs affecting gaming laptop prices.
Newegg Bundles Feature AMD Processors and DDR5 RAM with Substantial Discounts
Newegg has introduced various component bundles featuring AMD Ryzen processors and Corsair Vengeance DDR5 RAM, offering notable savings. These bundles include the Ryzen 5 9600X with 16GB RAM and a B650M motherboard for $519.99, along with a free AIO cooler. Such offers help mitigate high RAM prices, making them attractive for budget-conscious gaming PC builders.
Earth's Mantle Currents May Explain the Great Unconformity Geological Gap
A new study proposes that slow currents in Earth's mantle contributed to the Great Unconformity, a significant gap in the geological record. This mechanism suggests that mantle activity pushed continents up, allowing glaciers to erode them, before they sank and were covered by new sediments. This model offers an explanation for the Great Unconformity's presence in specific regions rather than globally, addressing limitations of the glaciation-only hypothesis.
Judge Rejects Trump's Claim EPA Can Dismiss Data Center Pollution Lawsuits
A federal judge rejected Donald Trump's argument that the EPA can unilaterally dismiss Clean Air Act lawsuits, specifically one against SpaceXAI over alleged data center pollution. This ruling affirms citizens' right to sue under the Clean Air Act, preventing the executive branch from blocking such legal actions at will.
Dropbox Acquires Tigris Data for $350M to Enter AI Infrastructure Market
Dropbox announced its acquisition of Tigris Data for $350 million, marking its largest acquisition to date. This move signifies Dropbox's entry into selling storage infrastructure to external developers and businesses, particularly for AI applications, through its new DBX Agent Cloud offering. The acquisition is expected to close in Q4 2026.