Alvaro Lopez Ortega / 2026-10-22 Briefing

Created Thu, 22 Oct 2026 15:21:38 +0000 Modified Thu, 22 Oct 2026 15:22:55 +0000
6235 Words

Microsoft says a ConnectWise breach let Chinese espionage actors compromise 2,250 cloud tenants, gaining privileged access in some environments in under three hours. AWS reported PHP2Shell exploitation began before disclosure, and Cloudflare saw millions of attempts. KeePassXC 2.8.0 arrived with Qt6, Wayland Auto-Type, remote sync and ARM64 builds. Nvidia’s Huang pushed AI-everywhere while protesters interrupted.

🔐 Security & Privacy

When the attacker becomes the user: Rethinking account takeover

Account takeover is a stealthy cyber threat in which attackers obtain credentials through phishing, increasingly aided by generative AI, then quietly monitor compromised email accounts before acting. Instead of immediately launching attacks, they weaponize the account to target employees, systems, customers, and suppliers through outbound phishing that appears to come from a trusted party. This can lead to financial loss, data theft, malware propagation, and reputational damage.

AWS PHP2Shell attacks predated disclosure

Amazon Threat Intelligence detected a PHP2Shell exploitation attempt on Oct. 17, 2026—four days before CVE-2026-109618 and CVE-2026-109619 were disclosed—and later observed multiple proof-of-concept exploits and exploitation attempts around the embargo lift. Cloudflare reported millions of exploit attempts targeting PHP2Shell, which is now broadly exploited. AWS recommends immediately upgrading to fixed PHP versions, using detections not reliant on CVE signatures, and considering blocking multipart file uploads only as a temporary measure if patching is impossible.

Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

Microsoft says a ConnectWise breach allowed Chinese espionage actors to compromise 2,250 cloud tenants. The attackers used AI agents and gained privileged access in some environments in under three hours.

Major pharmacy chain IT, auditors fought over ‘password’ on Cisco firewall

The IT department and auditors at a major pharmacy chain clashed over using “password” on a Cisco firewall. The dispute became intractable due to misaligned incentives.

Certification authority eMudhra defends its laughably weak private keys

eMudhra is defending its use of laughably weak private keys, saying it passed audits and that the issue was a minor, unexplained error. The certificate authority has not offered a detailed explanation for the flaw.

Police warned to watch people opposing Flock cameras at public meetings

A California intelligence fusion center issued a July bulletin warning police that city council meetings about Flock surveillance cameras could attract security risks and advising officers to watch for suspicious activity, while acknowledging no specific, credible threats had been found. The warning comes amid growing public backlash against Flock cameras, including the DeFlock movement, especially after the Los Angeles Police Department ended its Flock contract in July.

Dozens of universities in the blast zone after hackers exploit QuickLaunch

Attackers exploited known QuickLaunch and WSO2 vulnerabilities to create unauthorized accounts, steal account and internal system data, and access some university mailbox contents. Researchers identified at least 42 universities as potential targets, with records found across 1,079 domains, and an exposed attacker server contained scripts, attack notes, user records, and a DeepSeek API key. Mandarin-language reports suggest a Chinese-speaking operator, though researchers could not confirm the attacker’s location.

Signal’s sneaky bug: mic and camera eavesdropping on you post-call

A vulnerability in Signal’s RingRTC library before version 2.72.0 can prevent calls from fully disconnecting, potentially leaving audio and possibly video active after hangup. MITRE assigned CVE-2026-113380 a CVSS score of 9.3, but there is no evidence of active exploitation. Users should install available Signal updates to apply the RingRTC fix.

Free pass for US data requests? Seizure of far-left activist server sparks concerns in Europe

Dutch police seized an Autistici/Inventati server in Amsterdam at the US’s request under a mutual legal assistance treaty, prompting Dutch cloud providers to warn that the move lacked visible judicial oversight and could set a precedent for US access to European data. Prosecutors said the seized data has not yet been shared with US authorities, while the US terrorist designation had already forced the activist provider to lose banking, payments, and its website before shutting down services.

This AI aggregator leaked nearly 18 million files, including sex doll makers’ customer support chats

302.ai exposed 17.6 million files totaling 22.72TB through a publicly accessible Azure storage bucket, leaking chat logs, generated images, videos, audio, documents, and archived conversations. The exposed data included user prompts, assistant replies, timestamps, token costs, some PII, and enterprise customer-support chatbot logs linked to a prominent sex doll manufacturer. The data was taken offline after researchers contacted the company, with no evidence that malicious actors accessed or downloaded it.

Nigerian gets 8 years for phishing tax firms and stealing identities

Chukwuemeka Victor Amachukwu, a Nigerian national, was sentenced to 8 years in prison for spearphishing U.S. tax preparation firms, stealing identity data from at least 800 customers, and committing tax and loan fraud. His schemes sought $8.4 million in fraudulent tax refunds and obtained at least $2.5 million, plus over $7 million through a fake investment scheme; he was ordered to pay $3.6 million in restitution and forfeit nearly $11 million.

SafePay ransomware gang hits at least 600 organizations worldwide

SafePay ransomware has breached at least 600 organizations across critical infrastructure sectors worldwide, using stolen credentials, phishing, exposed systems, and legitimate remote-access tools to steal data before encrypting files and demanding payment. CISA and partner agencies urge organizations to patch vulnerabilities, enable multi-factor authentication, segment and monitor networks, and avoid paying ransoms.

Hackers knock Richmond schools offline, deface teachers laptops with ransom threats

Richmond Public Schools in Virginia took its network offline after hackers defaced staff laptops with ransom threats, disrupting Wi-Fi, cameras, PowerSchool, Chromebooks, and other systems across 53 campuses serving about 22,000 students. Schools remained open and shifted to technology-free learning while the district worked with law enforcement and outside cybersecurity specialists. Hackers claimed to have stolen sensitive data, but the district has not confirmed whether student data was accessed.

eMudhra Exits Global SSL/TLS Certificate Business

eMudhra’s board has decided to voluntarily exit its global SSL/TLS certificate business, citing the unit’s roughly 1% contribution to global revenue, rising compliance complexity and costs, reduced ROI, and disproportionate scrutiny after a recent incident. The company said it revoked the affected CAs within 14 hours, issued no end-entity certificates from them, and found no infrastructure compromise or data breach. It will focus on core enterprise solutions and other trust services, offer affected customers free certificate replacements during a managed transition, continue revocation/status services until certificates expire or are replaced, and said its other businesses remain unaffected.

Switch 2 Jailbreaking

The articles describe ns2jb as the first software-only, tethered jailbreak for the Switch 2, enabling arbitrary native code execution in ordinary and fs sysmodules for homebrew, game modding, save backups, and MMIO peripheral access, demonstrated by modding Mario Kart World. The research also covers initial WebKit code execution via a custom captive portal and exploration of a SmileBASIC 32-bit integer overflow for memory corruption.

1Password hits $500M ARR, up from $400M, driven by AI agents; launches 1Password for Agents

1Password has surpassed $500 million in annual recurring revenue, up from $400 million in November 2025, with a double-digit free cash flow margin. The growth is driven by enterprise adoption of AI coding assistants and agents, and the company announced 1Password for Agents to address security, access, and trust challenges.

x86 Kernel Shadow Stacks Being Worked On For Linux As Powerful Control Flow Protection

Intel engineer Dave Hansen has posted an RFC patch series to bring x86 kernel shadow stack support to Linux as a hardware-enforced control-flow protection against ROP attacks. The current implementation requires Flexible Return Event Delivery (FRED), limiting it to Intel Panther Lake and newer or AMD Zen 6 and beyond, with initial testing done on Panther Lake. It also has known incompatibilities with features including Retpolines, function graph tracing, BPF trampolines, Kexec, KVM, and Xen PV.

Linux kernel vulnerabilities accidentally disclosed

Several Linux kernel vulnerability reports were accidentally posted by Trend Micro’s Zero Day Initiative to the public Linux kernel mailing list instead of the private security list, prompting Greg Kroah-Hartman to question each public submission. The flaws are not yet patched in mainline—though some fixes are in testing or queued in “-next” branches—and carry CVSS scores up to 9.0, including SMB Direct and KSMBD remote code execution bugs plus local privilege escalation and information disclosure issues in components such as skbuff, VMWGFX, and NVMET.

Linux 7.4 Adapts AMD Zen 6 For Less Costly CPU Security Mitigation

The x86/bugs pull request merged for Linux 7.4 adjusts CPU security mitigations for AMD Zen 6 processors. It uses Zen 6’s new BTB CTX isolation feature to safely disable the expensive SRSO SafeRET mitigation, letting the stock kernel rely on the newer CPU capability instead.

What’s Getting Pwned

A live security-incident feed reports 191 incidents in the past year through Oct. 22, 2026, tracking critical, patched, partially fixed, and unpatched issues. Recent entries include U.S. banks detecting unauthorized third-party AI agents in customer accounts, a patched CVSS 10 unauthenticated RCE in self-managed GitLab (CVE-2026-110264), publicly leaked unpatched Linux kernel reports including CVSS 9.0 ksmbd RCEs, a LiteLLM 1.107.0 supply-chain compromise, and a BIND 9 GSS-TSIG replay memory-corruption flaw (CVE-2026-94300) with a partial fix.

I unknowingly broke the PHP RCE embargo. I am sorry.

The author apologized for unintentionally breaking a coordinated-disclosure embargo by posting about upcoming PHP RCEs CVE-2026-109618 and CVE-2026-109619. They said the post disrupted the disclosure schedule and created extra work, but they had been told there was no embargo and had intended to alert others to the urgency of the updates.

Python’s binary wheels and supply chain attacks

Artem Golubin warns that malicious code can be hidden in binary wheels uploaded to PyPI, since they may not match their accompanying source distributions. Because most security scanners analyze source code rather than compiled binaries, attackers could exploit prebuilt wheels that pip installs by default.

How to Run Turing-Complete Malware in PyTorch’s Backward Pass

Elon Litman showed that a malicious PyTorch loss function can report zero while still altering model weights through the backward pass. The exploit relies on disagreements between floating-point arithmetic and automatic differentiation, allowing gradient descent to execute arbitrary computations such as a cellular automaton. This creates a potential attack vector for AI training pipelines without modifying the base model, dataset, or optimizer.

🤖 AI & Machine Learning

Nvidia’s Huang: Don’t mention the AI-pocalypse

Nvidia CEO Jensen Huang is avoiding discussion of AI’s potential downsides, including job losses and existential risks. Instead, he used a Berlin keynote to promote Nvidia’s “AI-everywhere” vision, including open-weight models and faster datacenter deployments, while environmental protesters interrupted.

Vendors asking forward deployed engineers to make good on trillion-dollar AI bet

Vendors are leaning on highly paid forward-deployed engineers to help justify trillion-dollar AI bets, with some earning more than $200,000. Tech buyers should clarify who these engineers ultimately work for and put checks in place around their roles.

IBM CEO says open weight models are now irresistibly good and cheap on-prem

IBM’s CEO said open-weight AI models are now “irresistibly” good and cheap for on-premises deployment, offering roughly 90% of the performance at 10% of the price in just two or three racks. He argued that this combination is hard to beat.

AI Is Changing Everything About Hacking. No One Knows What Happens Next

Cybersecurity experts are alarmed by a wave of vulnerabilities, including the AI-discovered PHP2Shell flaws in PHP, alongside recent issues at eMudhra, Node.js, GitLab, Plex, Railway, and OpenCode. Cloudflare reported exploit attempts against PHP2Shell surging from thousands to millions within hours of its announcement. The rapid pace has experts warning of an AI-powered “Black Swan” event and uncertain what happens next.

AI Is Already ‘Amplifying the Destruction’ of War

The UN met this week to discuss autonomous weapons as the ICRC warned that AI is already “amplifying the destruction” and humanitarian harm in war. Efforts to govern killer AI have been weakened by Russia and the US, while AI systems are already selecting targets in Gaza and Ukraine, raising concerns about retained human control.

Tell your network to explain itself and then some

The article explains that meaningful hostnames and naming conventions become unwieldy for tracking network devices, while arp-scan can quickly enumerate IPv4 devices but often cannot identify what they are. It recommends using a local DNS server alongside DHCP to centralize device records, assign consistent IP addresses by MAC, and store arbitrary device information in DNS TXT records.

Nirva raises $25M for wearable AI companion offering relationship advice, total funding $33M

Nirva, a startup developing a wearable AI personal companion that offers relationship advice and other features, raised $25 million ahead of its November product launch. The new funding brings the company’s total raised to $33 million, CEO Wei Lyu told Axios Pro.

The Last Museum: Semantic search across 5.8M artworks from major museums

The Last Museum is a searchable online art collection spanning 3000 BC to 2026 and claiming over 6.3 million artworks. It highlights iconic works such as Hokusai’s Under the Wave off Kanagawa, Vermeer’s Girl with a Pearl Earring, Van Gogh’s The Starry Night, and Munch’s The Scream.

Achieving AI-style reasoning without an LLM

Minotaur is an AI architecture that performs deduction, induction, abduction, diagnosis, belief revision, and counterfactual/history reasoning without an LLM or GPU, using one operation on one ordinary processor core at about a quarter-second per question. It argues LLMs reason by imitating human written thought and inherit human biases, while Minotaur instead works directly on the structure of the system being reasoned about. In blind human-written tests, Minotaur reportedly matched a current language model on tasks including a police interview where questions alter memory and on learning, diagnosing, and predicting systems from data alone.

WorldTUI: I trained a 360M model to pretend to be a terminal

A developer fine-tuned a 360M-parameter Qwen2.5-Coder-0.5B model to simulate a terminal without a real shell or filesystem, predicting screen changes from raw keypresses and supporting apps such as vim, tmux, and Snake. Trained on terminal sessions recorded in Docker, the model treats the screen as a character grid and outputs row rewrites and cursor positions, with optimizations including COPY operations for scrolling and parallel row decoding; a WebGPU browser demo is available.

LLM agents play Pokemon showdown

A Pokémon Showdown 2v2 Gym-style environment was built to evaluate LLM agents’ coordination, communication, and negotiation. With Qwen3.8-27B teammates against a max-damage bot, free talk achieved a 64% win rate versus 42% with no talk, but used 978k prompt tokens per battle versus 259k. The environment also distinguished model strength: a Qwen3.8-27B team won 96% against 2B models and 74% against 9B models.

💻 Software & Open Source

KeePassXC 2.8.0 released

KeePassXC 2.8.0 has been released as the first stable version in the 2.8 series, bringing major features including migration from Qt5 to Qt6, Auto-Type on Wayland, configurable keyboard shortcuts, remote database synchronization, and quick unlock on macOS and Linux. It also adds native ARM64 Windows builds and an experimental AArch64 Linux AppImage, along with many bug fixes and security updates.

I built a garbage collector for Rust (2023)

The author built a garbage collector in Rust for Rust, aiming for an Rc/Arc-like Gc type that can detect and collect cyclic references. The article explains why Rust’s standard reference counting fails on cycles and outlines a design using Drop and a Collectable trait. It also discusses challenges such as undetectable moves, unsized data, and type erasure, while noting relatively few compromises.

Script dependencies with Nix

The article explains how to use Nix flakes to manage dependencies for simple scripts on non-NixOS Linux distributions, using a Python script that depends on Trafilatura and the system tool aplay as an example. It presents a reusable flake outline and uses writePython3Bin with makeWrapperArgs to create an executable whose PATH points to Nix-managed dependencies. This allows the script to run consistently without relying on pip or system-installed packages.

examining the macOS gcc binary

On macOS, /usr/bin/gcc is not a simple alias but a binary that uses xcselect/xcrun to launch the selected developer tool, rewriting names such as cc, c++, llvm-gcc, and llvm-g++ to clang or clang++. Although xcrun --find gcc can locate an actual gcc in CommandLineTools, that binary also shells out to xcrun and ultimately invokes clang/clang++. Xcode-installed developer tools are generally launched through xcrun.

Mesa Loosens Rules Around AI Agents For Code Comments / Commit Messages

Mesa has loosened its AGENTS.md rules to allow AI/LLM assistance in drafting code comments and commit or patch messages, as long as a human reviews and edits the final submission. Alyssa Rosenzweig said the previous restrictions were unnecessarily limiting for workflows using AI-generated drafts, while stressing the change does not alter Mesa’s underlying AI policy.

Myrlyn 1.1 Released For SUSE/openSUSE GUI Package Manager

Myrlyn 1.1 has been released as the first new feature update since the beginning of the year for the SUSE/openSUSE GUI package manager. It adds reboot notifications to the summary page, new repository filters, improved dark theme support with new icons, and other UI refinements.

Mesa RADV Change Satisfies More Steam Play Games On Aging AMD GFX8 GPUs

Valve merged a one-line Mesa RADV patch, targeted for Mesa 27.0 and backporting to stable, that enables Vulkan FP16 support by default on AMD GFX8 GPUs when running VKD3D-Proton. This should let more newer Steam Play games work on GCN 3rd/4th Gen and Polaris cards, including fixing SSAO in The Witcher 3 after its recent update. FP16 remains disabled globally because it can be slower than FP32 on these older GPUs.

Linux 7.4 Begins Landing Patches To Speed Up The Kernel Build Process

Initial patches by Arm engineer Lorenzo Stoakes have been merged into Linux 7.4 to speed up the kernel build process. The changes target build bottlenecks through optimizations such as faster kallsyms and cached compiler checks, with the full series reported to yield about 36% faster kernel builds and 70% faster incremental builds.

Crystal 1.22.0 Is Released

Crystal 1.22.0 has been released with 251 changes from 33 contributors. Key updates include SIGPIPE-emulating standard streams, revamped DWARF parsing, native event loop support on all targets, LLVM 23/24 support, and promotion of aarch64-linux to Tier 1. Breaking changes include exiting on pipe errors and removing Process.fork, alongside support for constants with type declarations and numerous HTTP improvements and fixes.

Faster than earcut: triangulating 3.7M map polygons in 489 ms

The map engine’s polygon triangulator has been released as earstrip, an ISC-licensed single-header C++ library and WebAssembly npm package that accepts the same arguments as earcut. Using ear clipping, it triangulates 3.7 million map polygons in 489 ms and is reported as 14% faster than earcut.hpp in C++ and 1.4–2.1× faster than earcut.js in the browser.

Cloudflare is rewriting everything in Rust

The article titled “Cloudflare is rewriting everything in Rust” could not be accessed because the page requires JavaScript to be enabled. No further details were available in the provided content.

A Markdown File Should Just Open

The author argues that Markdown, a simple and widely used 20-year-old format, should open as a formatted document on any computer or phone without extra software or extensions. He contrasts this with PDFs and calls on operating systems to treat Markdown as a first-class document format while still allowing easy access to raw syntax and direct editing.

OpenAI CLI

OpenAI introduced an official CLI for its REST API, installable via Homebrew or Go, with guidance on PATH setup and local execution. The CLI uses a resource-based command syntax, requires an API key for standard endpoints and an admin key for admin endpoints, and provides built-in help and shell shortcuts. It also includes update notices that can be disabled.

I can’t believe PowerShell is good

The author initially overlooked PowerShell but came to appreciate it as a powerful cross-platform automation and scripting tool after using it for a Windows project and on macOS. They now prefer it to Bash for anything beyond simple command sequences and often choose it over Node.js, Python, Automator, or Shortcuts.

The recently proposed o(n log n) integer multiplication algorithm [pdf]

A recently proposed integer multiplication algorithm is described as running in o(n log n) time. The PDF presents the proposal.

Django: check version support with norwegianblue

Adam Johnson demonstrates norwegianblue, a command-line tool powered by endoflife.date, for checking release cycles and support deadlines for Django, Python, PostgreSQL, and other software. It displays version compatibility, end-of-life dates, and upcoming support deadlines in a color-coded table, helping developers spot unsupported versions and plan upgrades.

How to improve technical SEO on a Django website

The article explains how to improve technical SEO on Django websites by implementing canonical URLs, XML sitemaps, robots.txt, structured data, and proper redirects. It provides practical Django code examples for controlling search engine indexing, preventing duplicate content, optimizing page performance, and monitoring results with Google Search Console.

Bringing uv and ty together

Astral has introduced an experimental uv–ty integration that enables dependency-aware type checking for Python scripts using PEP 723 inline metadata. The new uv check command automatically prepares project environments and runs ty, with support for workspace-wide checking and consistent ty versions via uv’s lockfile. The preview moves Astral’s Python tools toward a more unified development workflow.

Decoding base64 in Python at 10 gigabytes per second

Daniel Lemire introduced fastpybase64, a Python library built on SIMD-accelerated simdutf that serves as a drop-in replacement for Python’s standard base64 module. In single-threaded benchmarks decoding Base64 data with line breaks, it achieved over 13 GB/s, about 27 times faster than the standard library and four times faster than pybase64. It is available on PyPI for Linux, macOS, and Windows, supporting Python 3.10 through 3.14, including free-threaded Python 3.14.

Comprehensive Tutorial on Django ORM, Migrations and makemigrations

The tutorial explains Django’s ORM and migration workflow by building a coffee and tea store, covering model relationships, database queries, and the difference between makemigrations and migrate. It also demonstrates backfilling required fields, rolling back migrations, resolving conflicting migration histories, and using Django 6.1’s FETCH_PEERS mode to reduce N+1 database queries.

⚙️ Hardware & Engineering

Veteran ESA probe rolls out welcome mat for Japan’s Phobos mission

ESA’s veteran Mars Express probe could support Japan’s MMX Phobos mission when it arrives in 2027. Another “last ever” extension will keep the aging spacecraft flying to provide that support.

Why the immediate future of liquid cooling is hybrid

AI workloads are driving liquid cooling adoption as GPU racks exceed the practical limits of air cooling, with densities commonly at 40–100 kW and expected to reach 200 kW or more. However, most data centers will adopt hybrid cooling models that combine air and direct-to-chip liquid systems to balance density, flexibility, and operational realities. Hybrid strategies are expected to dominate through 2027–2028 as facilities support both legacy IT and next-generation AI accelerators.

To help world gorge on GPUs, Nvidia brings cash bucket to fatten wafer-thin supply chain

Nvidia is investing to expand the GPU supply chain, signing Samsung to build substrates and increasing spending with other partners. The move aims to ease supply constraints and help meet global demand for GPUs.

Enact exits stealth with $30M pre-seed for general-purpose robots backed by Mensch, LeCun

Swiss robotics startup Enact Intelligence has emerged from stealth with a $30M pre-seed round backed by Mistral CEO Arthur Mensch, Yann LeCun, and others. The company is developing full-stack technology for general-purpose robots that sense force and touch through actuators rather than relying primarily on cameras. It will use the funding to expand its team and accelerate hardware and R&D development.

Introducing TorchNeuron: Native PyTorch backend for AWS Trainium

PyTorch and AWS have introduced TorchNeuron, an open-source native PyTorch backend that lets developers run PyTorch models on AWS Trainium2 and Trainium3 accelerators with minimal code changes. Now in public beta, it supports eager execution, torch.compile, distributed training, custom kernels via the Neuron Kernel Interface (NKI), and performance profiling using familiar PyTorch APIs. TorchNeuron is released under Apache 2.0 at github.com/aws-neuron/torch-neuronx.

💼 Business & Policy

UK government hasn’t the foggiest how much it’s spending on digital transformation

The UK government is unable to determine how much it is spending on digital transformation, despite years of promises. Officials cannot provide a figure for the investment.

Philippine government suspends top tech official for alleged misconduct

The Philippine government has suspended a top technology official over alleged misconduct. The official, founder of an offshore software development firm, is being investigated for possibly giving government contracts to his former company.

Silicon Valley billionaires weigh exit strategies as California votes on new tax

California’s Proposition 40, scheduled for a November 3 vote, would impose a one-time 5% tax on billionaire residents’ net worth. Larry Page faces speculation he left California and could owe over $14 billion, while Jensen Huang says he is willing to pay and Mark Zuckerberg threatened to leave before striking a deal with Meta to stay. Stanford researchers found more billionaires left California than expected and said the tax’s net effect could be negative.

Trump asked Pichai to rename Atlantic Ocean on Google Maps, backed off after pushback

Former NBA player Enes Kanter Freedom was denied entry to WNBA Finals Game 3 in Atlanta after refusing to watch from a private suite arranged over his safety concerns; he left and said he was being silenced. The Atlanta Dream then beat the Valkyries 97-71 to take a 2-1 series lead.

Slingshot exits stealth with $27M seed for AI embedded insurance, co-led by Rally and Skyward

Minneapolis-based Slingshot Insurance has emerged from stealth with $27 million in seed funding co-led by Rally Ventures and Skyward Group. The AI-native embedded insurance startup helps businesses offer small policies by connecting them with insurers and using AI to process data, with Vertical Insure as its first customer and design partner. Slingshot’s first program is set to launch this month, and the company is pursuing an acquisition that would allow it to back policies itself.

Visa in late-stage talks to buy Fireblocks for ~$2.5B in stablecoin sector

Visa is reportedly in late-stage talks to acquire stablecoin custody and infrastructure provider Fireblocks for about $2.5 billion. The deal would mark Visa’s first acquisition in the stablecoin sector, according to sources cited by Axios.

Israeli firm Lava finds 32 Nvidia B300 chips in China Telecom-linked systems despite US controls

Andreessen Horowitz plans to rename its flagship blockchain fund from a16z crypto to a16z frontier and broaden its investment strategy beyond crypto, according to a person briefed on the matter. The fund has raised nearly $10 billion across five funds and has informed some limited partners of the change.

Meta: ~$825B lease/contract commitments, up from ~$700B; $355.7B off-balance-sheet leases; META -5%+

Meta disclosed about $825 billion in future lease and contract commitments, up from nearly $700 billion in July, many tied to AI computing power and infrastructure. It said $355.7 billion in operating and finance leases—covering data centers and energy infrastructure through 2036—are not yet on its balance sheet. Meta shares fell more than 5% following the filing.

a16z drops ‘crypto’ from flagship fund, rebrands as ‘a16z frontier,’ broadens beyond crypto

Andreessen Horowitz plans to remove “crypto” from the name of its flagship blockchain fund, rebranding it as “a16z frontier.” The move broadens the fund’s investment strategy beyond crypto.

Meta Europe Q3 ad growth slows to 18%, lagging US/Canada

Meta’s European ad revenue grew 18% year over year in Q3, down from about 40% in Q1 and 24% in Q2, and lagged 33% growth in the US and Canada. The slowdown follows the EU rollout of Meta’s Less Personalized Ads option, which Meta has previously flagged as a potential headwind and analysts say is contributing to weaker European ad performance.

Epic Games Inc v Apple Inc

In Epic Games Inc v Apple Inc (No 2) [2026] FCA 1552, Beach J of the Federal Court of Australia determined relief after earlier findings that Apple contravened s 46 of the Competition and Consumer Act 2010 (Cth) concerning iOS mobile devices and operating system software. The court addressed declarations that contractual terms were void under s 87 and the scope of mandatory and prohibitory injunctions under s 80, including nexus to contravening conduct, lawful conduct, territorial reach, and international comity. It made both prohibitory and mandatory injunctions.

Tesla profits drop 43% in Q3

Tesla reported Q3 2026 revenue of $28 billion, nearly flat year over year, as automotive revenue fell 3% and solar/battery revenue dropped 16%, while services rose 33%. Operating expenses jumped 39%, operating margin fell to 2.6% from 5.8%, and net profit dropped 43% to $787 million. Capital expenditures rose 110% and free cash flow fell 62% to $1.5 billion.

The era of speedball capitalism

The provided article contains no substantive news content; it only displays a notice asking readers to enable JavaScript and cookies. Therefore, no factual summary of its reporting can be produced from the available text.

📱 Consumer & Platforms

iPhone Duo review leaves some users second-guessing their preorders

Marques Brownlee’s review of the $2,000 iPhone Duo praised its display, hinge, battery life, and software animations but criticized its weight, average camera, lack of Face ID, and unoptimized apps. The review prompted some users to cancel or reconsider preorders ahead of the October 23 launch. Bloomberg’s Mark Gurman called the reviews unusually harsh but suggested app optimization issues could be resolved within weeks.

Surfshark early Black Friday deal 2026 is live: sale with 88% OFF

Surfshark’s early Black Friday 2026 sale is live, offering up to 88% off VPN plans plus three extra months free for up to 27 months. The 2-year Starter and One plans cost $2.49 per month, while One+ costs $3.99 per month. All plans include a 30-day money-back guarantee.

Users want the YouTube dislike button to be left in peace

YouTube is testing moving the dislike button into an overflow menu, leaving only the like button clearly visible. Users are criticizing the change as making it harder to signal unwanted or AI-generated content, especially after YouTube removed public dislike counts five years ago while still showing them to creators in YouTube Studio.

Garmin Revamps and Opens Up Connect Developer API Program

Garmin has reopened and revamped its Garmin Connect API developer program after closing it to new applicants for about seven months, introducing Personal, Startup, and Enterprise access tiers. The Personal and Startup tiers are free, with Startup supporting up to 1,000 users, while Enterprise adds more API areas, technical support, historical data, and costs money. The change aims to simplify access after Garmin was overwhelmed by applications, including many AI-generated apps.

Apple debuts ‘Made for iPhone Duo’ App Store badge; Netflix, Zoom, Word among launch apps

Apple is rolling out a “Made for iPhone Duo” badge in the App Store to indicate apps optimized for the foldable’s extra screen real estate. Apple is touting Netflix, Prime Video, Zoom, Microsoft Word, and Outlook at launch for using the Duo’s inner and outer screens in features like side-by-side tools, video with shared content, and varied viewing modes. The iPhone Duo launches Friday starting at $1,999 with limited walk-in availability.

Xbox wants you to pay 24 to 40 cents per hour to stream games you bought

Microsoft has rolled out à la carte Xbox Cloud Playtime purchases to Xbox Insiders, priced at 10 hours for $4, 25 hours for $8, or 50 hours for $12, with purchased time available until used. The packs require owning a cloud-playable game or accessing select free-to-play titles, so streaming costs come on top of game purchases and differ from Game Pass’s included streaming access.

Claude Now Works with Google Docs, Sheets, and Slides

Claude for Google Workspace is now in public beta on all paid Claude plans, adding a sidebar add-on for Google Docs, Sheets, and Slides that can read, edit, and suggest changes in open files. New beta connectors also let Claude create and edit Google files from within Claude chat. The add-on supports existing models, connectors, skills, and enterprise controls, with file access matching users’ Google sharing permissions.