Continuing · Security · High impact
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
WIRED · Lily Hay Newman & Matt Burgess · · 7 sources
Concerns are being raised that neither the Commerce Department nor Nvidia are doing their due diligence when it comes to vetting Chinese firms cleared to handle the company's H200 AI chips. According to The New York Times , New Matrix is on the list of approved firms, yet its…
The Verge · Terrence O’Brien · · 2 sources
Continuing
OpenAI is now valued at $1.25 trillion in a new round of funding that has raised another $11 billion, according to Bloomberg . That would make it one of the world's most valuable companies, not long after raising $122 billion from investors in March at a valuation of $852…
The Verge · Stevie Bonifield · · 6 sources
Security · High impact
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek .
SecurityWeek · Eduard Kovacs · · 3 sources
Continuing
Anthropic's IPO plans are running into a punishing post-election selloff, prompting a rethink among prospective investors of the company's expected valuation, which could now be as low as $1.2 trillion, according to sources. Bloomberg's Seth Fiegerman joins Tim Stenovec on…
Bloomberg Technology · · 4 sources · 💬 601
Continuing · Security · High impact
In this article Mitigation and protection guidance Microsoft Defender detections Hunting queries Indicators of compromise In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive…
Microsoft · Microsoft Threat Intelligence · · 5 sources
Security · High impact
Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000…
Security
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems.v [...]
Watch · new today
Security
A memo circulated earlier this year reportedly claimed that China’s Ministry of State Security recruited a female technology executive to spy on Nvidia's CEO.
TechCrunch · Anthony Ha · · 2 sources
Security · High impact
Book: System Design Pocket Guide: Interviews The series: Pocket Guides for Developers — 8 short books on agents, RAG, prompts, observability, events, databases and system design — the whole series My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code…
DEV · Gabriel Anhaia ·
Anthropic CEO Dario Amodei. | Photo: Jason Henry/Bloomberg via Getty Images Anthropic is using AI to build more powerful AI. And it appears to be working remarkably well, with the company's models improving roughly twice as quickly as a year ago, with little indication of slowing…
The Verge · Robert Hart ·
Watch & listen · new today
Watch the full show on YouTube: https://www.youtube.com/watch?v=P735f1xlpL0
The Asahi Linux developers have put out a new report on their progress toward a Linux distribution for Apple devices. Some time ago, we were made aware of multiple attempts to exploit our permissive licensing to hijack our work, with a direct view to replacing the project and…
AWS first introduced Kiro , its agentic, spec-driven development environment, in July 2025. It also introduced Kiro Crew in August of this year, its persistent, open-source development workspace that remembers context. Now, to help developers juggle more complex tasks executed in…
Release
Microsoft released Azure Linux 3.0.2022 on Friday night as the newest version of their in-house Linux distribution. Given the rampant AI/LLM-fueled bug reporting and security research, Azure Linux 3.0.2022 ends up incorporating more than 470 security fixes for different CVEs…
Listen · new today
This week on Ship It Weekly, GitHub will block pull_request_target in public repos by default from December 2, with brownouts on Mondays, November 9 and 16, 11 AM to 1 PM ET. A WordPress core update race (CVE-2026-119977) is on CISA's exploited list: during a full-package update, a fresh installer can sit for a moment at a public URL under wp-content/upgrade. A hijacked DebugBear script drained about $2.7 million from Polymarket users after DebugBear's DNS was compromised through its registrar. And Alpine Linux explains why upgrading GitLab didn't fix CVE-2026-97229 on its own image: the fix was a patch to Ruby. The thread: what actually ran, as opposed to what you think ran. A trigger that
The announcement comes barely more than a week after hackers stole $6.3 billion worth of cryptocurrency from Binance users.
TechCrunch · Anthony Ha · · 2 sources
Cade Metz / New York Times : Exponential Time Hypothesis co-proposer Russell Impagliazzo calls OpenAI's disproof “shocking news”; it could one day speed up chip design and break encryption — A longstanding hypothesis held that some problems would always be hard…
Techmeme ·
Apple's iPhone Duo has been officially on sale for two weeks, and the company said today that the App Store now has over 100,000 apps that are built for the foldable. "It's been wonderful to see how quickly developers have embraced iPhone Duo, and we're grateful for their…
The Verge · Jay Peters · · 3 sources
Listen · new today
I’ve always enjoyed talking to security expert Alex Stamos because he’s so direct — and he doesn't mince words about how the multibillion dollar cybersecurity industry as we’ve known it is all but doomed thanks to the unrelenting, AI-boosted waves of hacks, breaches, and attacks. That much disruption means a lot of places where bad guys can get in while everyone else is left scrambling. Alex isn’t a doomer in the long run, but he does think we've got a dark age to get through before things get better. Links: Attack of the killer script kiddies | The Verge Alex Stamos on AI's coming cybersecurity dark age | Ground Level AI Palo Alto’s CEO Said ‘AI Must Fight AI’ | Palo Alto Networks Cybersecu
Security · High impact
While inspecting the web traffic of hiddenweb , I stumbled upon a major database security flaw. By changing a single query parameter, I was able to access a leaked database containing over 1,000 cleartext customer emails and private multi-tenant store data. Responsible Disclosure…
Security · High impact
TL;DR. raw_user_meta_data holds whatever the browser passed to supabase.auth.signUp() . On one production app the handle_new_user trigger read the new user's role from it, so anyone could sign up with the Owner role id and own the account. The fix is to take the role from a table…
DEV · Denys Zaichenko ·
Release
On behalf of the team and everyone who has contributed, I'm happy to announce that Spring Boot 4.2.0-RC2 has been released and is now available from Maven Central. This release includes 99 enhancements, documentation improvements, dependency upgrades, and bug fixes . Notable…
Fonte original: PromptX.blog . Leia a análise completa no site. A aplicação de modelos de inteligência artificial de fronteira ao universo das ciências da vida atinge no início de novembro de 2026 o seu momento de maior sofisticação teórica e maturidade regulatória. Durante os…
Security
TL;DR What: Nautobot 's GraphQL API enforced object permissions at the root of a query but not when a query traversed into related models. In my local test on v3.1.4, an account with view permission on Location and no device permission got a 403 from the REST device list and an…
Release
On November 5, 2026, Google made Gemini Omni 1.2 Flash ( gemini-omni-1.2-flash ) generally available across the Gemini API and Google Cloud. Two weeks after shutting down Veo 3.1 Preview in the developer API on October 22, Google is positioning Omni Flash as its default model for…
DEV · Ishank Choudhary ·
Listen · new today
We all love a duo episode, but this week's duo isn't Kris and Matt, it's Kris and Nick! Yes, after joining us last week as a guest, Nick Gerace of East River Source Control is back to join Kris. The two dig into the latest changes to the AI plans we've all come to love, what constitutes something actually being slop, and where in the loop humans belong. Nick is also apparently auditioning to become a Fallthrough co-host! Let us know your thoughts on that. In this episode, Nick argues that the frontier labs stay winning regardless of the strategy you pick, whether that's Oxide's human-centric approach or the software factory agent-centric approach. Meanwhile, Kris argues that Ghostty is defin
Release
Updated November 1, 2026: Node.js 26 is now Active LTS. This guide was first published in July, when 26 was still the Current line and the advice was "test now, wait for LTS". That wait is over. Node.js 26 became a Long Term Support release on October 28, 2026. The Node.js…
DEV · Somnath Khadanga ·
Release
TL;DR: new CustomElementRegistry() gives a shadow root its own private set of custom element definitions, so two libraries can both own a <ui-button> on the same page. Firefox 159 shipped it on October 27, 2026, which makes scoped custom element registries Baseline Newly…
I wanted to know whether a small store backend could take HEIC photos from sellers and turn them into JPEG with nothing but sharp. On 2026-11-06 I tested the prebuilt sharp 0.34.5 from npm on an Apple M4 Mac, and the answer was half yes. metadata() read a HEIC file without…
Watch · new today