Tech News
Daily technology news: launches, pricing changes, AI and software updates, and security incidents, explained with the context that matters.
Latest
Windows 11 November update KB5132061 fails to install on PCs that took the October preview
Microsoft confirms KB5132061 can loop with errors 0x80070306, 0x800f0989 or 0x800f0993 after preview KB5127936. Its automatic repair should finish by 10am PT on November 13.
SSHole: OpenSSH Bypass on Alpine and musl Linux Is Exploited, CISA Deadline Is Today
CVE-2026-123158 lets a 257-1024 character password log into password-less accounts on musl Linux without PAM. It is exploited in the wild and CISA's KEV deadline is Nov 12. Here is who is affected and how to fix it.
OpenAI Releases GPT-6 Cyber, a 'Critical'-Rated Hacking Model Locked Behind Daybreak Red
OpenAI's offensive-security model scores 48.5% on ExploitGym and stayed in scope in 99.93% of honeypot runs. Access is gated to vetted Daybreak Red customers, and key questions remain open.
Anthropic's Claude Fable 5.2 cuts API prices 20% and formalizes Fermat's Last Theorem in 30 hours
Anthropic released Claude Fable 5.2 and Mythos 5.2 on Nov 9: $8/$40 per million tokens, up to 30% faster outputs, and a 1,000-agent Lean proof of Fermat's Last Theorem in 30 hours.
Claude Personal Finance Beta Reads Your Bank Accounts Through Plaid, but Can't Move a Dollar
Anthropic's new Personal Finance beta lets US Pro, Max and Ultra users link up to 16 banks through Plaid. Claude sees balances and two years of transactions, read-only. Here is what it can see, what it can't do, and the privacy fine print.
Apple will check public iCloud links for harmful content starting in iOS 27.3
A new Apple support document says items shared with 'Anyone with the Link' will be checked for undefined harmful content in iOS, iPadOS, macOS and visionOS 27.3, with possible account bans and law-enforcement referral.
Postman's Desktop App Quietly Installed Its Plugins Into Claude Code and Codex, Then Pre-Approved Its Own Hook
A Postman desktop upgrade added agent plugins to Claude Code and Codex without asking and auto-trusted a Codex startup hook. Here is what changed and how to remove it.
Marvell to Buy Lumentum in $115 Billion All-Stock Deal Betting on Optical AI Networks
Marvell agreed to acquire Lumentum for 4.5 shares each, an implied $115 billion enterprise value. Both stocks fell sharply as investors questioned the price.
Binance's $6.3B Hack: FBI Blames North Korea's TraderTraitor as Withdrawals Reopen
The largest crypto theft on record started on a DevOps engineer's laptop. Binance says it has covered 95% of the stolen assets, reopened withdrawals on 15 networks and owes users a full proof of reserves on November 3.
Apple tells stores to repair or replace cracked iPhone Duo inner screens, but there is no recall
An Apple memo tells stores to inspect and repair or replace iPhone Duo units whose inner display cracks at the hinge. What owners get, what it costs outside coverage, and what iFixit thinks is behind it.
Google's Gemini 4 Carbon goes to cyber defenders first, two weeks after Argon
Google DeepMind's Gemini 4 Carbon tops its own benchmark table and leads on cyber tests, but only vetted defenders in the Fairwind Program can use it for now.
Apple's MacBook Pro with PROLED XDR Display Is the First Touchscreen Mac, and Touch Costs $400
Apple's new 14- and 16-inch MacBook Pro adds a tandem OLED touchscreen and a Dynamic Island on the same M5 Pro and M5 Max chips, for $400 more. Here is what changes, what it costs and who should buy it.
Cloudflare: GLM-5.3 on Workers AI Leaked Other Users' Prompts in 155 Responses - SGLang Operators Should Upgrade
Cloudflare's post-mortem says a KV cache sizing mistake and an SGLang prefill/decode bug let 155 long-prompt GLM-5.3 responses carry other customers' data between Aug 27 and Sep 9, 2026. The fix is upstream in SGLang.
Anthropic Files S-1 for Nasdaq IPO as ANT: $16.3B First-Half Revenue, First Operating Profit
Anthropic's public S-1 shows revenue jumping from $4.6B in 2025 to $16.3B in the first half of 2026, a first operating profit in Q2, an $80.7B mostly non-cash net loss and a founder share with 50.1% of the vote.
eMudhra CA keys were tiny numbers, one was 4: Chrome drops the emSign root on October 27
Eight eMudhra intermediate CA keys could be recovered in milliseconds. Browsers blocked them within hours, Chrome removes emSign ECC Root CA - G3 on Tuesday, October 27, and eMudhra is leaving the global TLS business.
Node2Shell: Node.js Brotli Bug CVE-2026-111497 Now Has a Working RCE Exploit
Node.js patched a Brotli decoder overflow (CVE-2026-111497, CVSS 9.2) found by OpenAI Codex Security. Imperva's Node2Shell shows code execution. Upgrade to 22.23.4, 24.22.1 or 26.12.1.
Anthropic's Claude Duet Is a Proactive Agent That Messages You First
Claude Duet checks your connected apps every few hours, sends a morning brief and finishes work on its own cloud computer. It runs on Claude Opus 5.5 and is a US waitlist preview for Pro and Max.
PHP2Shell: PHP Rushes Out Emergency Fix for Two Critical RCE Flaws After a Leak
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, unauthenticated RCE bugs dating to PHP 5.4. What to update, and what to do if you can't.
Qilin and INC ransomware gangs exploit PAN-OS GlobalProtect flaw CVE-2026-0257 to bypass MFA
Unit 42 says Qilin and INC ransomware operators are using CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions past MFA, then pivot to vCenter and ESXi. Fixed versions, workarounds and indicators.
OpenCode Console breach exposed saved OpenAI, Anthropic and Google API keys
An intruder reached a legacy OpenCode Console system and stole third-party AI provider keys from 1.4% of Console users, who woke up to hundreds of dollars in rogue usage. Here is what happened, how the providers responded and what to do now.
Plex2Shell: Outdated Plex Media Servers Hijacked to Mine Monero and Resell Bandwidth
A four-CVE chain Plex fixed on September 1 went from public proof-of-concept to in-the-wild attacks in under a day. Servers on 1.43.2 or earlier are being turned into XMRig miners and proxy nodes.
Meta Releases Muse Spark Open: An 816B Open-Weight Model That Runs on Two Mac Studios
Meta published the weights of Muse Spark Open, an 816B-parameter multimodal model co-optimized with Apple for M5 Ultra Mac Studios. Here is what it can do, where it trails, and what the license demands.
Microsoft's October 2026 Patch Tuesday fixes more than 1,400 flaws, including an exploited Windows zero-day
Microsoft's largest security release ever patches 1,400+ CVEs, led by CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass already used in attacks. CISA set an October 16 deadline.
Apple HomeView Is Here: A $299 Smart Home Display Built Around Siri AI
Apple launched HomeView, a $299 7-inch smart home display with an A18 chip, face recognition for up to six people and Siri AI, alongside a new Apple TV 4K, HomePod mini 2 and the Apple Home Collection.
Microsoft unveils Maia 300 AI chip, plans multi-gigawatt rollout from 2027
Microsoft's third-generation Maia 300 accelerator promises 40% more inference tokens per megawatt than leading GPU systems, with production deployments starting in 2027.
New GhostAction Wave Hijacks 500+ GitHub Accounts to Steal Cloud and AI API Keys From Git History
A fake security-audit.yml workflow pushed through compromised maintainer accounts now sweeps every branch and the full git history for AWS, Anthropic, OpenAI, GitHub and other keys. Here is what changed and what to do.
Amazon Replaces Fire Tablets With Android-Based Alexa Tablets, Adds Google Play and Alexa+
Amazon's new Alexa Tablet 8, 11 and 12 Pro run Android with Google Play and Alexa+, start at $229.99, and replace the Fire tablet line.
Microsoft's $2,599 Surface Laptop Ultra Bets Windows on Local AI Agents
Microsoft and NVIDIA opened preorders for the RTX Spark-powered Surface Laptop Ultra, made MXC agent sandboxing generally available and laid out hybrid AI for Windows.
Reflection AI unveils Beam, a 501B open-weight model that bets on efficiency
Reflection AI's first frontier model, Beam, is a 501B-parameter mixture-of-experts with 23B active parameters. It claims GLM-5.2-level reasoning on 3-4x less compute, but the weights are not out yet and the benchmarks are unverified.
Googlebook Goes on Sale: Five Android-Based Laptops From $899 Take On the Chromebook
The first Googlebooks from Acer, ASUS, Dell, HP and Lenovo hit shelves on October 4, priced $899 to $1,299, as Google sets a mid-2034 end date for ChromeOS updates.
FortiMail zero-day CVE-2026-104286 is being exploited, and there is no patch yet
An unauthenticated, CVSS 9.8 file-write flaw in FortiMail's IBE webmail portal is under active attack. Fixed builds are still "upcoming", so the workaround is the only defense right now.
Google's Gemini 4 Argon Brings 1M-Token Output, but Only Cyber Defenders Can Use It
Google DeepMind announced Gemini 4 Argon on September 30 with a 1M-token output limit and $2/$10 introductory pricing, but access is limited to the Fairwind Program for now.
Google Puts Its AI Chips in Orbit: Project Suncatcher Prototype Launches With Four TPUs
Google's first Project Suncatcher satellite, built with Planet, launched on SpaceX Transporter-18 on October 1 with four TPUs aboard. Here is what the test covers, its limits, and why Google says space compute will not be cheaper anytime soon.
Cloudflare Turns HTTP 402 Into a Paywall for AI Agents With Monetization Gateway
Cloudflare's Monetization Gateway closed beta lets websites, APIs and MCP tools charge AI agents per request over HTTP 402 and x402, settled in USDC on Base.
OpenAI DevDay 2026: GPT-6.1 Sol, always-on dots and a $500 ChatGPT Pro plan
OpenAI's DevDay 2026 brought GPT-6.1 Sol at one-fifth of GPT-6 Astra's API price, always-on dot agents, Astra Ultrafast behind a new $500 Pro plan, and plugin extensions inside ChatGPT.
AMD Agrees to Buy Fei-Fei Li's World Labs for $8.2 Billion in Stock
AMD will acquire World Labs, the spatial-intelligence lab led by ImageNet pioneer Fei-Fei Li, in an all-stock deal worth about $8.2 billion. Li becomes AMD's Chief Scientist, reporting to Lisa Su.
Microsoft Rebuilds Copilot Into One Work App With Home, Code and Autopilot
On September 25, 2026 Microsoft relaunched Copilot as a single business app with Home, Office, Code and Autopilot agents, plus a new split between flat licences and usage-based billing.
WordPress CVE-2026-87902: Critical Core Flaw Exploited Hours After the 7.1.2 Patch
WordPress 7.1.2 fixes a CVSS 9.2 path-traversal bug in page-template resolution that dates back to 4.7. Attackers were probing within hours, and CISA's federal deadline is September 28.
Google fined €403 million in Ireland over location data
Ireland's Data Protection Commission has fined Google €403 million under the GDPR over location data in Web & App Activity, Location History and Location Accuracy, and given it six months to comply.
Meta Connect 2026: VR Glasses, Camera-Free Ray-Ban Meta Audio and Muse on Your Face
Meta unveiled 100-gram VR Glasses at $1,299.99, its first camera-free Ray-Ban Meta Audio at $349, Ray-Ban Meta Gen 3 at $449 and plans to bring its Muse AI agent to glasses.
Alphabet's Intrinsic Open-Sources Intrinsic Core, Its Industrial Robotics Platform
Intrinsic released Intrinsic Core under Apache 2.0 at ROSCon 2026: the real-time control, motion planning, perception and simulation stack it runs in real factories, plus an open CNC machine tending reference design.