Top stories
Railway Detects Unauthorized Access to Encrypted Customer Environment Variables
Railway detected unauthorized access to systems storing customer environment variables, potentially exposing encrypted and some decrypted contents like API keys and database credentials. The company believes this is part of a broader attack targeting platform companies and AI inference providers, prompting a recommendation for all users to roll their environment variables.
Node.js Updates Fix Brotli Decoder RCE Vulnerability Across Supported Versions
Node.js released security updates for versions 22.x, 24.x, and 26.x to address 10 flaws, including a high-severity remote code execution (RCE) vulnerability in its bundled Brotli decompression code. This flaw, an out-of-bounds write, could allow an attacker to run arbitrary code if an application decompresses attacker-controlled Brotli data. Users of unsupported Node.js versions (20.x and earlier) must upgrade to a supported line to receive the fix.
Unpatched Tailscale SSH Flaws Allow Root Access on Other Servers From a Hacked Device
A security researcher identified unpatched vulnerabilities in Tailscale SSH that allow a compromised device to gain root access on other servers within the network. The attack requires Tailscale SSH to be configured for port forwarding and an attacker to control an initial device with network access to the target, posing a risk to networks using the affected configurations.
Google DeepMind Releases Genie 4 World Model with Enhanced Realism and Audio Generation
Google DeepMind has launched Genie 4, an updated AI world model that generates interactive virtual experiences with increased realism and the ability to create audio. The model uses Gemini 3.8 Flash for simulations, extends experience duration to two minutes, and allows real-time updates via natural language prompts. Genie 4 is currently available as a research preview to trusted testers, offering potential applications in filmmaking, game prototyping, and robotics training.
Eye Security Disables Vulnerable Time4Popcorn Updater to Prevent Botnet Formation
Eye Security researchers took control of abandoned domains used by the "Time4Popcorn" app, a fork of Popcorn Time, to push an update that disabled its updater service. This action prevented potential remote code execution (RCE) attacks on millions of Windows, macOS, and Android devices still running the outdated software. The vulnerability, tracked as CVE-2026-30612, stemmed from unencrypted HTTP updates and a lack of digital signature verification, which could have allowed attackers to execute malicious code with full privileges.
Amazon's Bee Introduces Two New AI Devices: Frontier Wearable and Eclipse Card
Amazon's Bee has launched two new AI-powered devices: the Bee Frontier, a wearable, and the Bee Eclipse, a credit-card-sized device. These devices record and transcribe conversations, using AI to generate summaries, to-dos, and insights, and integrate with Amazon services and Google accounts. The Frontier is priced at $74.99 and the Eclipse at $99.99, marking Amazon's expansion in the personal AI gadget market.
LiteLLM 1.107.0 on PyPI Compromised with Credential Stealer and Backdoor
The LiteLLM Python package version 1.107.0, distributed via PyPI and Docker images, was compromised in a supply chain attack. This malicious release installed a credential stealer and a remote code execution backdoor, which collected sensitive data like SSH keys, cloud credentials, and AI tool tokens, and established a persistent daemon for further code execution. PyPI has since removed the affected release, and LiteLLM is investigating the incident, noting that stolen GitHub CLI OAuth tokens from three engineers' accounts were used to publish the malicious version.
Google Updates Privacy Policy to Allow Ad Targeting Based on Gmail, Drive, Photos Data with AI Opt-in
Google updated its privacy policy on October 16, allowing data from Gmail, Drive, and Google Photos to be used for personalized ads if users opt into AI features that access this data. This change means that enabling Google's Personal Intelligence feature, which connects these services to AI tools for better recommendations, can now result in ads targeted based on that content. Previously, Google's policy stated it would not use this data for personalized advertising.
Quest Diagnostics Reports Cyber Breach of Patient Records on Quanum Lab Services Manager
Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager platform, potentially compromising certain patient records. The company discovered the breach on Wednesday and is investigating the scope of affected data and patients, while working with federal law enforcement and cybersecurity experts.
TSMC and Samsung Commit to ASML's High NA EUV Chipmaking Tools
TSMC and Samsung, the world's largest chipmakers, have committed to using ASML's High NA extreme ultraviolet (EUV) lithography machines for advanced chip production, driven by increasing demand for AI applications. This adoption signifies a move towards more intricate chip designs and improved manufacturing efficiency, with Samsung planning to use the technology for DRAM production from 2028.
Chrome's Safe Browsing Enhanced Protection Mode Improves Phishing and Scam Detection
Google Chrome updated its Safe Browsing Enhanced Protection mode with new features to detect suspicious and dangerous sites, and to counter ClickFix social engineering attacks. These updates aim to make users ten times safer from various online threats compared to Standard Protection by leveraging Gemini models and clipboard analysis.
Automattic CEO Matt Mullenweg Placed on Paid Leave, Mark Davies Named Interim CEO
Automattic founder and CEO Matt Mullenweg was placed on a paid leave of absence by the company's board of directors. CFO Mark Davies has been appointed interim CEO, a decision Mullenweg stated was made without his consent and against his vote. This change in leadership affects Automattic, the parent company of WordPress, Tumblr, and Pocket Casts.
Revolut Experiences Widespread Service Disruption Amidst Google Cloud Outage
Revolut, a digital bank, experienced a significant service disruption affecting multiple services globally, including card payments, transfers, and ATM withdrawals. The outage, which began on Tuesday morning, left thousands of users unable to access funds or make payments. This incident occurred concurrently with elevated errors and intermittent network failures reported by Google Cloud in its europe-west2 region, impacting various Google Cloud services and other companies.
Leaked DLSS 5 Library Found in NBA 2K27, Modders Get it Running in Control
A new Nvidia library, nvngx_dlssnr.dll, associated with DLSS 5 neural rendering technology, was found in the early access version of NBA 2K27. Modders successfully implemented this leaked DLSS 5 library into the game Control, demonstrating its functionality and initial performance characteristics on Blackwell GPUs. This leak provides an early look at Nvidia's upcoming rendering technology ahead of its official fall release.
NY Congressman Introduces Bill to Protect Digital Video Game Ownership
Representative Ritchie Torres plans to introduce the Power to the Players Act, a bill directing the FTC to establish regulations ensuring consumers own, rather than license, purchased video games. This initiative aims to prevent situations where games become unplayable due to server shutdowns or delistings, as exemplified by NBA 2K25.
Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
An alleged member of the Qilin ransomware group was arrested in Japan and extradited to Germany, where the individual is wanted for a ransomware attack against a logistics company. This arrest targets a core member of a prolific ransomware-as-a-service operation responsible for attacks on hundreds of organizations globally.
Cloudflare to Launch Public Certificate Authority Supporting Post-Quantum Cryptography
Cloudflare announced its intent to become a public Certificate Authority (CA) and has applied for inclusion in major root programs, including Chrome, Apple, Microsoft, and Mozilla. This initiative includes plans to be among the first CAs to issue post-quantum certificates, specifically Merkle Tree Certificates (MTCs), targeting early 2027 for inclusion in Chrome's Quantum-resistant Root Store. The move aims to address the performance challenges of post-quantum cryptography at internet scale and expand Cloudflare's role in web encryption.
Microsoft President Brad Smith Calls for Urgent Global AI Regulation
Microsoft President Brad Smith stated that artificial intelligence is currently less regulated than common products like milk and washing machines. He advocated for urgent global safety rules, including legal obligations for incident reporting, "kill switches" for AI systems, and independent evaluation of new AI technologies to manage potential risks. This call for regulation aligns with warnings from other AI companies and comes as the UK government prepares to legislate for greater AI oversight.
Amazon warns against blocking data centers, citing risks to US economy and national security
Amazon Web Services CEO Matt Garman published a blog post urging communities to support AI data center projects, arguing that blocking them could harm the US economy and national security. The post addresses public concerns regarding data centers' impact on jobs, power, and the environment, while also announcing a "Data Center Commitment" to invest in communities and end nondisclosure agreements with government agencies.
Waymo reveals details of custom computing hardware powering its robotaxis
Waymo has disclosed key details about the custom computing hardware, including its silicon chip, that powers its autonomous robotaxis. This revelation provides insight into the technology enabling Waymo's driverless operations, which currently involve 4,000 vehicles across more than 10 cities.
Attackers hijacked TLDs to mint counterfeit TLS certificates for Google and other services
Attackers compromised three country code top-level domains (.gh, .sl, .as) to modify DNS records and obtain unauthorized TLS certificates for Google and other major online services. This allowed them to impersonate affected infrastructure, prompting Google to update Chrome to block these certificates and advise domain owners on preventative measures.
International Coalition Seizes Hacking Tools Linked to China's Integrity Technology Group
An international coalition, including the FBI and U.S. Department of Justice, seized websites supporting the hacking tools Microscan and FishHub. These tools were used by China-based Integrity Technology Group, a company contracted by China's Ministry of State Security, to conduct vulnerability scanning and intrusions targeting critical infrastructure globally, including in the U.S. and Taiwan.
MonsterCloud CEO Charged for Allegedly Defrauding Ransomware Victims with Secret Payments
Zohar Pinhasi, CEO of MonsterCloud, has been charged with wire fraud for allegedly defrauding ransomware victims between June 2018 and June 2023. Prosecutors claim Pinhasi's company, MonsterCloud, secretly paid ransoms to attackers for decryption keys while falsely advertising proprietary data recovery technology. Pinhasi then charged clients significantly marked-up fees, with one instance showing an $8,200 ransom payment resulting in a $150,000 charge to the client.
Finnish Authorities Halt Google Data Center Preparatory Work Over Environmental Concerns
Finnish authorities have ordered Google to suspend preparatory work at two planned data center sites in Muhos and Kajaani, Finland, due to the absence of mandatory environmental impact assessments (EIAs). The Finnish Supervisory Agency (LVV) issued the order after Google's subsidiary, Tuike Finland Oy, cleared over 300 hectares of forest and performed other site alterations without the required assessments. Google acknowledged it "fallen short of our own high standards" and will comply with the agency's guidance, impacting its €13bn investment in Finland.
Musician Sentenced to 18 Months for $10 Million AI-Assisted Streaming Fraud
Michael Smith, a 54-year-old North Carolina musician, received an 18-month prison sentence for orchestrating a $10 million streaming royalty fraud scheme. Between 2017 and 2024, Smith used AI-generated songs and automated bots to artificially inflate streaming numbers on platforms like Spotify, Apple Music, Amazon Music, and YouTube Music. This case marks the first criminal conviction in the US for AI-assisted streaming fraud, highlighting a new method of financial crime in the digital music industry.
Sonos Ace Ultra Headphones with Voice Control and New Colors Revealed in FCC Filing
Sonos is preparing to launch new over-ear headphones, potentially named Sonos Ace Ultra, following an FCC filing. These headphones, model S52A, are expected to be a premium successor to the 2024 Sonos Ace, featuring support for voice commands and five color options. This release aligns with Sonos's strategy to integrate AI and conversational computing into its hardware ecosystem.
Google Labs Launches AI-Powered Playground for Browser-Based Game Creation
Google Labs has introduced "Playground," an experimental AI platform that enables users to create browser-based games using text prompts without coding or drawing. The platform leverages AI models like Gemini, Nano Banana, and Lyria to simplify game development, allowing users to define game mechanics, physics, and graphics through a chat interface. This initiative aims to make game creation more accessible and expand the pool of game creators.
Cloudflare remediates cross-tenant data exposure vulnerability in Containers
Cloudflare fixed a vulnerability in its Containers and Sandboxes services that could have exposed residual disk blocks from other tenants. A security researcher reported the issue, which allowed Workers Paid account users to potentially recover data from previously used storage blocks on the same host. Cloudflare found no evidence of malicious exploitation and applied a fix across its Container fleet.
New Mexico Jury Rules Meta Misled Residents on Data Privacy
A New Mexico jury found Meta violated the state's Unfair Practices Act and misled residents regarding data privacy and misinformation handling. This verdict stems from a 2021 lawsuit related to the Cambridge Analytica scandal, where Facebook user data was used for political advertising.
International Law Enforcement Dismantles KillSec Ransomware Group, Identifies Teen Leader
An international law enforcement operation, "Operation KillSwitch," has dismantled the KillSec ransomware group, seizing its dark web leak site and five core servers. Authorities identified a 16-year-old as the alleged administrator and main operator, made three provisional arrests, and blocked access to 110TB of stolen data. This action disrupts a group linked to approximately 1,000 suspected attacks worldwide.
HP Launches OmniBook 5 14 Laptop with OLED Display Starting at $699.99
HP introduced the 2026 HP OmniBook 5 14 laptop, featuring an OLED display across all configurations and starting at $699.99. The device includes Intel Core 5 or Core 7 processors, up to 16GB RAM, and up to 1TB SSD storage, positioning it as a competitor in the budget-friendly laptop market.
Apple Patches CoreGraphics Vulnerability Potentially Exploited in Targeted Attacks
Apple released security updates for iOS, iPadOS, and macOS to fix a CoreGraphics vulnerability (CVE-2026-86950) that could allow arbitrary code execution. Apple stated the flaw may have been exploited in targeted attacks against specific individuals on older iOS versions. The updates address the issue with improved bounds checking.
Florida AG Seeks Court Order Against OpenAI for ChatGPT's Human-like Attributes and Model Development
Florida Attorney General James Uthmeier has requested a court order to prevent OpenAI from giving ChatGPT human-like attributes, arguing this deceives users and increases engagement for data collection. The motion also seeks to block OpenAI from developing new AI models without third-party approved safety guardrails and to restrict minors' access to ChatGPT. This action is part of an existing lawsuit against OpenAI, initiated after a criminal investigation following a 2025 mass shooting where the suspect allegedly used ChatGPT.
EU Kids Act Proposes Social Media Ban for Under-13s, Parental Supervision for 13-14
The European Commission introduced the EU Kids Act, a proposal to ban social media access for children under 13 and require parental supervision for 13- and 14-year-olds. The legislation sets a minimum age of 15 for independent social media account creation and mandates platforms to implement "safe by design" features, including parental controls and restrictions on addictive elements.
Meta Hires MongoDB CEO CJ Desai to Lead New Enterprise Platform
Meta Platforms hired CJ Desai, former MongoDB CEO, to lead its new Meta Enterprise Platform, which will focus on AI tools for businesses. This move caused MongoDB shares to drop 20% and Meta's stock to decline 4%.
US Proposes AI Incident Alert System to China Ahead of Trump-Xi Talks
The U.S. proposed a notification mechanism for AI incidents with national security implications during discussions with China. This initiative aims to increase transparency between the two leading AI powers and sets a precedent for international cooperation on AI risks.
British Columbia Sues OpenAI and Sam Altman Over Tumbler Ridge School Shooting
British Columbia has filed a lawsuit against OpenAI and CEO Sam Altman in California, alleging the company failed to warn law enforcement about a mass school shooting planned using ChatGPT. The province is seeking damages for recovery efforts and changes to OpenAI's handling of conversations that could lead to violence.
Anthropic Establishes Bio Research Lab for Physical Experiments in Bay Area
Anthropic has opened a biology research lab in the San Francisco Bay Area to conduct physical experiments, confirming its commitment to real-world lab work in conjunction with AI. This development indicates Anthropic's expansion into biological research beyond its existing drug discovery program, potentially leveraging AI to accelerate treatment development.
Microsoft and Partners Dismantle EvilTokens AI Cybercrime Platform, Two Arrested
Microsoft, in collaboration with partners including Health-ISAC, Cloudflare, and OpenAI, has taken down EvilTokens, an AI-powered cybercrime platform. The platform, which offered AI tools for account compromise and financial fraud, led to the arrest of two men, aged 32 and 38, in the UK by the Metropolitan Police Service.
Microsoft sets new Patch Tuesday record with over 650 security fixes for Windows
Microsoft released over 650 security fixes for Windows in its September Patch Tuesday, setting a new record. This increase in patched vulnerabilities is attributed to new AI models, like Anthropic's Mythos and OpenAI's cybersecurity model, which are discovering software flaws at a rapid pace.