Top stories
Critical Vulnerabilities in Paperclip AI Platform Allow Remote Code Execution
Two critical security flaws in Paperclip, an open-source control plane for AI agents, could allow attackers to execute commands on network servers or developer computers. The most severe vulnerability, CVE-2026-41679, has a CVSS score of 10.0 and allows remote code execution without prior authentication, while another flaw (GHSA-x8hx-rhr2-9rf7) enables execution on developer machines. A third flaw exposed sensitive data through unauthenticated API routes.
OpenAI's Astra AI Model Solves 10 Long-Standing Math and Computer Science Problems
OpenAI introduced Astra, an unreleased AI model, after an internal version achieved ten significant advances in mathematics and theoretical computer science. These problems had seen no progress for at least a decade, and in some cases, much longer, indicating a potential shift in AI's capability for foundational scientific research.
RefluXFS Linux Kernel Flaw Allows Local Root Access on XFS Filesystems
A nine-year-old Linux kernel flaw, dubbed RefluXFS (CVE-2026-64600), allows unprivileged local users to overwrite root-owned files on XFS filesystems and gain persistent root access. This race condition vulnerability affects systems running Linux kernel v4.11 or later with XFS filesystems created with `reflink=1`, including default installations of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux.
IBM shares drop 25% after disappointing Q2 results and profit warning
IBM's shares declined over 25% following a profit warning and disappointing preliminary Q2 results. Revenue of $17.2 billion fell short of analysts' expectations, reflecting a shift in corporate spending priorities amidst rising demand for AI infrastructure.
FBI and CISA Warn of Russian Phishing Attacks on Signal and WhatsApp Accounts
The FBI and CISA have issued an updated warning about Russian intelligence phishing campaigns targeting Signal and WhatsApp accounts. Attackers are using Signal Backup Recovery Keys to hijack accounts, and the U.S. is offering a $10 million reward for information on the group responsible. The campaign has compromised thousands of accounts of high-profile targets, including government officials and journalists.
Acer Predator Helios Neo 16S AI Gaming Laptop Discounted at Best Buy
The Acer Predator Helios Neo 16S AI gaming laptop is discounted by $300 at Best Buy, now priced at $1,899.99. This laptop features a 16-inch QHD+ OLED display with a 240Hz refresh rate, an Nvidia GeForce RTX 5070 Ti GPU, and an Intel Core Ultra 9 processor. The discount offers a compelling option amidst rising component costs affecting gaming laptop prices.
Newegg Bundles Feature AMD Processors and DDR5 RAM with Substantial Discounts
Newegg has introduced various component bundles featuring AMD Ryzen processors and Corsair Vengeance DDR5 RAM, offering notable savings. These bundles include the Ryzen 5 9600X with 16GB RAM and a B650M motherboard for $519.99, along with a free AIO cooler. Such offers help mitigate high RAM prices, making them attractive for budget-conscious gaming PC builders.
Judge Rejects Trump's Claim EPA Can Dismiss Data Center Pollution Lawsuits
A federal judge rejected Donald Trump's argument that the EPA can unilaterally dismiss Clean Air Act lawsuits, specifically one against SpaceXAI over alleged data center pollution. This ruling affirms citizens' right to sue under the Clean Air Act, preventing the executive branch from blocking such legal actions at will.
Dropbox Acquires Tigris Data for $350M to Enter AI Infrastructure Market
Dropbox announced its acquisition of Tigris Data for $350 million, marking its largest acquisition to date. This move signifies Dropbox's entry into selling storage infrastructure to external developers and businesses, particularly for AI applications, through its new DBX Agent Cloud offering. The acquisition is expected to close in Q4 2026.
DreamHost Initiates Mandatory Password Reset for Affected Email and FTP/SFTP Users
DreamHost is requiring a password reset for some email and FTP/SFTP users due to an active incident. Account owners can reset passwords via the control panel, and emails with instructions are being sent in batches.
Apple's Inventory Surges 154% Amid "Unprecedented" Memory Chip Price Hikes
Apple's inventory increased by 31.1% quarter-over-quarter and 154.3% year-over-year, reaching $14.54 billion in Q4, driven by rising memory chip costs. CEO John Ternus described the current memory pricing as "unprecedented" and anticipates even higher costs in the December quarter, which will impact gross margins. Apple has already raised prices for iPads, MacBooks, and iPhones to offset some of these increased expenses.
AI Companion Platform Character.ai Files for Chapter 11 Bankruptcy
Character.ai, a developer of AI companion applications, filed for Chapter 11 bankruptcy protection due to high development costs, litigation liabilities, and regulatory issues. The company cited the costly nature of developing and growing its AI entertainment platform, alongside legal fees and an inability to generate sufficient cash flow. A court-supervised sale is planned, with Disney acting as a stalking horse bidder for some intellectual property.
GM to Pay $220 Million to Settle Claims of Illegally Selling Driver Data
General Motors will pay $220 million to settle claims from 36 U.S. state attorneys general that it illegally sold driver and location data through its now-discontinued Smart Driver program. The settlement requires GM to obtain express consent from drivers before collecting or sharing their data and to limit the types of driving data it gathers. This action addresses concerns about consumer privacy and data sharing practices in connected vehicles.
Mistral Releases Weights for Multimodal Mistral Large 4, Nicknamed "Le Chonk"
Mistral has released the weights for its Mistral Large 4 (ML4) model, also known as "Le Chonk," a multimodal, multilingual Mixture-of-Experts (MoE) model with approximately 1 trillion total parameters and 49 billion active parameters. This model accepts text and images as input to generate text and features a 1 million token context window. ML4 demonstrates improved performance in agentic coding and defensive cybersecurity benchmarks, positioning it as a competitive open-weight model for self-hosted deployments.
Florida and Three Other States Sue TP-Link Over Router Security and China Ties
Florida, Montana, Iowa, and Nebraska have filed lawsuits against TP-Link, alleging the company misrepresented the security of its routers and its connections to China. These lawsuits claim TP-Link engaged in unfair and deceptive trade practices, following a US FCC ban that prevents TP-Link from selling its latest Wi-Fi 8 routers in the US.
ConnectWise Credential Compromised, Granting Access to 173 Microsoft 365 Tenants
A compromised credential for ConnectWise Cloud Backup (formerly SkyKick) has been used by unknown threat actors to access 173 Microsoft 365 customer tenants. This incident allows attackers to obtain Microsoft Graph tokens and access sensitive data due to the application's broad permissions.
Google Launches Public SynthID Website for AI Content Detection
Google has launched a new public website, SynthID.com, allowing anyone to verify if images, videos, or audio clips are AI-generated using its SynthID technology. This tool, previously available to select professionals, now supports watermarks from Google's own models (Nano Banana, Veo, Lyria, Gemini, Flow, ProducerAI, Vids) and partners like OpenAI, Nvidia, and Kakao, with Apple support coming soon. The website addresses the growing need for AI content identification by making verification accessible to a broader audience.
Claude Opus 5.5 Released, Offering Improved Performance and Reduced Cost
Claude Opus 5.5, the first model in the Claude 5.5 family, has been released, performing at the level of Claude Fable 5.1 on most tasks while costing 40% less than Opus 5. This new model demonstrates significant performance improvements in complex tasks like code migration and software optimization, alongside enhanced safety features.
Zero-Click Candiru Spyware Delivered via Targeted Online Ads to Al Jazeera Journalists
Citizen Lab researchers confirmed that Candiru spyware infected devices at Al Jazeera through zero-click targeted online advertisements. This marks the first public technical confirmation of mercenary spyware using targeted ads for infection, requiring no user interaction. The attacks affected at least 45 Al Jazeera journalists and also targeted networks of government agencies and international organizations.
Research finds all 21 tested vehicles transmit data to third parties, over half to advertisers
Researchers from Northeastern University and Consumer Reports found that all 21 modern vehicles they tested transmit data to third-party domains, with over half sending data to advertising companies. This study systematically investigates data collection practices in connected vehicles, highlighting a lack of transparency and control for car owners.
California Governor Newsom Issues Executive Order for AI Safety and Oversight
California Governor Gavin Newsom issued an executive order to establish state-level AI oversight, citing a lack of federal action. The order directs a group of experts to provide recommendations within two months for strengthening AI safety laws, potentially including requirements for independent safety plans and "kill switches" for frontier AI companies. This initiative positions California to lead in AI regulation.
Google suspends open-source bug bounty program due to invalid AI-generated submissions
Google has suspended its Open Source Software Vulnerability Reward Program (OSS VRP) for product vulnerabilities, effective October 1, 2024. This action was taken due to an overwhelming number of invalid bug reports generated by AI, which burdened engineers and maintainers. The suspension highlights a growing challenge in cybersecurity as AI-driven tools generate false positives, impacting resource allocation for legitimate security work.
Images of Meta's 'Project Phoenix' Mixed Reality Headset Leaked from HorizonOS Firmware
Images of Meta's "Project Phoenix" mixed reality headset have surfaced from a HorizonOS app, revealing a slim, glasses-like form factor. The leak suggests Meta is developing a device that bridges the gap between smart glasses and full VR headsets, potentially competing with products like Xreal or Viture.
Kiteworks Urges Customers to Shut Down Servers Due to Imminent Cyberattack Threat
Kiteworks advised its customers to shut down their systems after receiving credible threat intelligence from law enforcement about an imminent cyberattack. The company recommended a precautionary shutdown to protect against potential zero-day exploits, though no compromise has been confirmed.
Reddit Restricts Old Reddit Access and Ends RSS Support Citing AI Scraping
Reddit is implementing new restrictions on its 'Old Reddit' interface and discontinuing support for RSS feeds, effective November 13. These changes are part of the company's efforts to combat large-scale data scraping and automated abuse, particularly from AI bots. Additionally, Reddit plans to end public API access by March 2027.
Apple Watch Series 12 and Ultra 4 to feature AI-powered daily recaps using sensor data
The upcoming Apple Watch Series 12 and Apple Watch Ultra 4 will include a new AI feature that generates daily recaps of user activities and conversations by utilizing microphone, GPS, and other sensor data. This development positions the Apple Watch as a competitor in the AI wearable market, offering automated personal assistance for logging daily events.
Apple ordered to pay $5.7 billion in patent infringement case over iPhone and Apple Watch haptics
A federal jury in San Diego awarded Taction Technology over $5.7 billion in damages after finding Apple infringed on two haptics patents. The lawsuit alleged Apple's Taptic Engine in iPhones and Apple Watches used Taction's vibration technology without license, a claim Apple denies and plans to appeal.
Anthropic Accuses Chinese AI Labs of Illegally Distilling Claude Models
Anthropic's head of threat intelligence, Jacob Klein, stated that foreign adversaries, particularly Chinese AI labs, are illegally accessing and distilling its Claude models to train competing AI technology and sell cheaper copycat versions. This practice, which Anthropic considers theft of intellectual property, is intensifying as the company approaches a potential IPO and has prompted concerns from the U.S. government regarding undermined American research.
Google DeepMind Introduces Gemini 3.8 Live Models for Voice Agents
Google DeepMind launched Gemini 3.8 Live and Gemini 3.8 Live Extended Thinking, two new AI models designed to improve near real-time reasoning for voice agents. These models aim to make AI conversations more intuitive and intelligent, with Gemini 3.8 Live for scalable applications and Gemini 3.8 Live Extended Thinking for high-complexity tasks requiring multi-step reasoning.
Microsoft discontinues 'Copilot Plus PC' branding for new Surface devices
Microsoft is no longer using the 'Copilot Plus PC' brand for its new 12-inch Surface Pro and 13-inch Surface Laptop, despite these devices meeting the technical requirements. This change indicates a shift away from the branding, which was originally intended to highlight PCs with built-in AI capabilities.
Qualcomm Unveils Dual Snapdragon 8 Elite Gen 6 Chips with Enhanced On-Device AI
Qualcomm announced two new flagship smartphone processors, Snapdragon 8 Elite Gen 6 and Snapdragon 8 Elite Extreme Gen 6, both built on a 2nm process. These chips focus on improving on-device AI capabilities, enabling local execution of large AI models and enhanced personalization for AI agents. The Extreme version offers additional performance improvements in AI processing, video capture, and gaming, positioning them for premium Android smartphones.
GitHub Actions and Pages Experience Degraded Availability, Migration to Azure Accelerated
GitHub experienced degraded availability for GitHub Actions and Pages on August 6, leading to failing or delayed workflow runs and impacting services like Copilot and GitHub Enterprise Importer. In response, GitHub is accelerating its architectural roadmap for Actions, including a full migration of the service to Azure to improve isolation, resiliency, and scalability.
Google Launches Pixel Tag Item Tracker with UWB and Bluetooth Channel Sounding
Google has released the Pixel Tag, a new item tracker priced at $29, designed to compete with Apple's AirTag. It features Ultra Wideband (UWB) for precision finding and Bluetooth Channel Sounding, integrating with Google's Find Hub network to help Android users locate lost items.
Cloudflare moves to post-quantum cryptography with ML-KEM and ML-DSA
Cloudflare is transitioning its encryption methods to ML-KEM and ML-DSA to address quantum computing threats. The U.S. NIST standardized these algorithms in 2024, and Cloudflare aims for full post-quantum security by 2029.
Sony Music and Warner Chappell Sue Anthropic for Copyright Infringement
Sony Music and Warner Chappell have filed a lawsuit against Anthropic, alleging the AI company used "tens of thousands" of copyrighted works without permission to train its Claude AI models. The suit seeks up to $150,000 per work, potentially totaling billions, and names Anthropic's co-founders as individual defendants, claiming they were involved in illegal downloading of content.
Liquid Network loses $320 million in Bitcoin to purported white-hat hackers
The Liquid Network, a Bitcoin sidechain, had approximately $320 million (4,000 BTC) drained from its federation wallet by individuals claiming to be white-hat hackers. These individuals state they will return the funds once a vulnerability is fixed, prompting Liquid to suspend transactions and engage with them.
GoPro Merges with Starman Optical for $285M, Expands into AI Data Centers and Defense
GoPro announced a $285 million merger with optical-photonics company Starman Optical, with GoPro shareholders receiving $1.14 per share and retaining 10% ownership. This deal will clear GoPro's $92 million debt and enable the company to enter the AI data center market, defense, robotics, and aerospace sectors, diversifying its business beyond action cameras.
Cyberattack Exposes Data of 8.7 Million Customers at Three UK Airports
Manchester Airports Group (MAG) reported a cyberattack affecting approximately 8.7 million customers across Manchester, London Stansted, and East Midlands airports. The breach compromised personal data such as email addresses, phone numbers, vehicle registrations, and postcodes, but no financial information was accessed.
Google Not Forced to Sell Ad Exchange After Antitrust Loss; Behavioral Remedies Imposed
A US federal judge ruled that Google will not be required to sell its online advertising exchange (AdX), despite losing an antitrust trial in 2025 where it was found to have illegally locked publishers into its exchange. The Department of Justice (DOJ) had sought the divestiture, but the court instead accepted undisclosed "behavioral remedies" that will mandate Google open its ad tech tools to rivals. This decision limits the structural penalties Google faces following the antitrust verdict.
Google Pics AI Image Editor Rolls Out to Workspace and AI Pro/Ultra Subscribers
Google has launched Google Pics, an AI-powered image creation and editing tool, to Google AI Pro and Ultra subscribers, and most Workspace business customers. Built on the Nano Banana generative AI model, Google Pics integrates directly into Workspace applications like Docs, Slides, and Drive, allowing users to generate and edit images with granular control over prompt-based manipulation and object segmentation.