Alvaro Lopez Ortega / 2026-11-06 Briefing

Created Fri, 06 Nov 2026 11:55:11 +0000 Modified Fri, 06 Nov 2026 11:56:22 +0000
4381 Words

Delhi Police sought takedowns via X targeting SFLC.in, Internet Freedom Foundation and censorship-monitoring posts, alarming transparency advocates. A decade-old SSH flaw lets attackers bypass login checks on Alpine Linux, routers and other musl systems with passwords of 257–1024 characters. CERT-IN warned of AI-powered weekend attacks on Indian fintechs, while the Bank of England cautioned that AI spending may not yield a productivity boom.

🤖 AI & Automation

Bank of England pours cold water on AI productivity boom

The Bank of England is casting doubt on hopes that massive AI investment will automatically produce a productivity boom. It suggests that spending billions on GPUs does not necessarily translate into broad efficiency gains.

UK ministers seek powers to investigate when AI agents are let off the leash

UK ministers are seeking powers to investigate cases where operators lose control of AI agents. The Cyber Security and Resilience Bill could enable searches, seizures, and inspections of automated systems in such situations.

AI agents are a ‘bane’ for some website operators, says Cloudflare

Cloudflare’s CEO said AI agents are a “bane” for some website operators. He also claimed sovereign actors likely exploited PHP2SHELL long ago and suggested containers are dead.

I struggle to believe that AI R&D is ingenious

The author is skeptical that autonomous AI R&D is genuinely ingenious, citing side projects where models show poor basic judgment, produce similar and methodologically incomplete papers, and write hard-to-understand reports. The main exception is hill-climbing tasks with fast feedback loops, where repeated prompting improved performance, though key advances still required human suggestions. The author notes newer coding models have better judgment than earlier ones but remain far from true research taste.

Closed AI models dominate the price-performance frontier

Closed AI models now dominate the price-performance frontier, with open-weight models the best buy at only 3% of budgets—down from 41% in June. Recent closed releases such as OpenAI’s GPT-6 Luna and GPT-6.1 Terra and Anthropic’s Claude Haiku 5.5 have reclaimed budgets that open models briefly won. Closed labs benefit from distilling their own frontier models, releasing full model families, and serving inference at massive scale.

Thinking Machines Lab debuts Inkling 2 Small

Thinking Machines Lab has debuted Inkling 2 Small, a Mixture-of-Experts model with 594B total parameters, 17B active parameters, image-input support, and variable effort. It scores 31 on the Artificial Analysis Intelligence Index, with gains in agentic coding, vision, knowledge work, and reasoning. The model is initially available through Tinker with closed weights, while full weights are planned for release under Apache 2.0 next week after external safety testing and red-teaming.

Google rolls out Gemini Omni 1.2 Flash: up to 15-sec clips, better reference adherence, 30% cheaper

Google is rolling out Gemini Omni 1.2 Flash, a video-generation model that creates clips up to 15 seconds—up from 10—with conversational editing and improved reference adherence. It costs 30% less than its predecessor, at $0.07 per second for 720p video, and is available through the Gemini API, AI Studio, Cloud Console, Flow, Vids, the Gemini app for Ultra subscribers, and Ads. Every generated video carries an imperceptible SynthID watermark.

Perplexity launches Teammates, always-on AI agents for multiple roles and large tasks

Perplexity has launched Teammates, an always-on AI agent system that integrates with Perplexity Computer to handle multiple roles and execute ongoing, large-scale tasks simultaneously. The feature, which competes with OpenAI’s Dots and Claude Duet, requires the $200-per-month Max plan and lets users monitor agents through threads in the Perplexity app or interact with them in Slack.

Artificial Analysis: Inkling 2 Small matches Gemini 3.8 Flash; top open outside China when released

Thinking Machines has released Inkling 2 Small as a proprietary model on its Tinker platform, with Apache 2.0 weights planned for a later, unconfirmed date. It scores 31 on the Artificial Analysis Intelligence Index v5.0.1, matching Gemini 3.8 Flash (high) and surpassing Xiaomi’s MiMo-V2.6-Pro, and its planned weight release would make it the highest-scoring open-weights model developed outside China.

🔐 Security & Privacy

Threat actor targets Indian fintechs on weekends when defenders aren’t watching

CERT-IN warns of a significant escalation in AI-powered attacks targeting Indian fintechs, with threat actors often striking on weekends when defenders are less vigilant. Some attacks occurred after victims tried to improve their defenses.

NordVPN vs Surfshark Black Friday deals 2026: which offers better value?

NordVPN and Surfshark’s 2026 Black Friday deals offer discounted VPN subscriptions and security bundles, with NordVPN up to 78% off from $3.49/month and Surfshark up to 88% off from $2.49/month. Both add three extra months to two-year plans, and Surfshark also adds them to annual plans; both offer money-back guarantees. Surfshark Starter is the cheapest option, while NordVPN Complete is better for broader security needs such as a password manager and 1TB of cloud storage.

Any long password will do: SSH flaw lets hackers into Alpine systems, routers and more

A decade-old SSH flaw allows attackers to bypass login checks on Alpine Linux and other systems using the musl library by entering any password between 257 and 1024 characters. The vulnerability mainly affects accounts without passwords, including root, and can be exploited by anyone with network access to the SSH port. Administrators should update OpenSSH, restart the SSH service, or disable password logins until patched.

Chainalysis cyberattack exposes usernames, password hashes, and authentication tokens

Chainalysis suffered a cyberattack using “offensive agentic techniques” that exposed usernames, names, password hashes, and live authentication tokens for its users. The company said it has no evidence that investigation data was accessed or attribution data was manipulated, and it reset all customer passwords. It urged users to change reused credentials elsewhere and took some products offline while keeping money-laundering monitoring tools online under close watch.

Dutch ‘idealist’ bank ASN blocks non-Google Android, including GrapheneOS

Users report that ASN Bank’s app requires Google Play Services to log in, blocking customers on non-Google Android systems such as GrapheneOS and SailfishOS. In response, Wero said it is prioritizing mainstream Apple and Android platforms and will not dedicate resources to troubleshooting unsupported configurations.

Bomb threats disrupt at least 25 flights across Europe, raising hybrid war fears

Hoax bomb threats disrupted at least 34 flights across Europe this week, including at least 25 on Thursday, forcing some emergency landings; all planes landed safely and searches found nothing suspicious. The apparently coordinated threats raised fears of hybrid warfare, though investigators said there was no evidence yet of orchestration by a hostile state or terror group. The airlines body IATA condemned the disruption and urged authorities to identify the origin of the threats.

Pwn.college

pwn.college is a free, hands-on cybersecurity education platform maintained by hackers at Arizona State University that uses a belt system and practical challenges to teach core computing and security skills. Its challenges are used in university courses worldwide, so the platform asks users not to publicly post solutions and allows educators to import challenges into private dojos for their students.

Why your Mac may not scan for malware

Macs have long scanned themselves for malware silently, and Apple replaced the Malware Removal Tool with XProtect Remediator (XPR), which runs scheduled background scans but skips them on battery power and limits daily scans with a timer. Since XPR version 163, released on September 18, 2026, users can no longer run the scanner manually, and attempts fail silently—leaving macOS without a user-runnable malware scan for the first time since MRT.

Barracuda Email Security Gateway pre-auth remote root RCE: CVE-2026-116606, CVE-2026-111560

watchTowr Labs analyzed two Barracuda Email Security Gateway flaws: CVE-2026-116606, a critical pre-authentication authorization bypass (CVSS 9.3), and CVE-2026-111560, a high-severity OS command injection (CVSS 8.6). The flaws affect ESG and several other Barracuda products and are fixed in version 9.4.0.029; when chained, they can enable pre-authentication remote root code execution.

Blockaid: Binance hackers stole ~$2.5B, 40% of $6.3B, in one Ethereum tx via $15 wallet permissions

Blockaid reported that hackers who stole $6.3 billion from Binance took about $2.5 billion, or 40% of the haul, in a single Ethereum transaction. They exploited wallet permissions that cost just $15 to set up, letting software move funds without separate authorizations for each transfer.

🐧 Linux & Open Source

Ubuntu Moving Ahead With Plans For Splitting Up Linux-Firmware, HWE Option

Ubuntu is moving forward with plans to split the monolithic linux-firmware package and introduce a linux-firmware-hwe package for updated firmware blobs. The changes missed the official Ubuntu 26.10 release but are being pursued for Ubuntu 27.04 and may be backported via SRU to Ubuntu 26.10 and potentially Ubuntu 26.04 LTS.

Linux Developers Look To Drop RT_GROUP_SCHED As It’s “Broken Beyond Repair”

Linux kernel developers are considering removing RT_GROUP_SCHED, a cgroups v1 feature for real-time task group scheduling described as “broken beyond repair.” The feature is disabled in major distribution kernels, and a proposed removal patch is expected to move forward despite concerns about remaining unspecified users and whether it should be deprecated first.

Sound Subsystem Seeing Lots Of Fixes & Laptop/Device Quirks For Linux 7.4-rc2

The Linux 7.4-rc2 sound subsystem is receiving a high number of fixes and device-specific workarounds, with many laptop quirks included in maintainer Takashi Iwai’s latest batch. The changes cover HP models, ASUS audio popping, Alienware bass speakers, and headset/microphone issues on Huawei, Acer, and Lenovo laptops.

OpenCV 5.1 Brings More AVX-512 Optimizations, Other Improvements

OpenCV 5.1 has been released with more AVX-512 and other SIMD optimizations, expanded FP8 support, and new RISC-V RVV vector kernels. It removes the classic DNN engine in favor of the new OpenCV 5.0 engine and adds CUDA/cuDNN improvements, an OpenGL-based 3D visualizer, improved Java/JavaScript/Python bindings, and hundreds of bug fixes. OpenCV 5.1.0 is available from GitHub.

Blender’s UI and Runtime: Much Faster Than GPUI

Blender’s user interface, as a library you can use from Python, Rust, JavaScript/React, C, C++ and Dear ImGui.

People spent decades building and optimizing Blender’s GUI. It’s battery and memory efficient, and super duper fast. We decoupled it, to give…

From Linux to Wikipedia: How Volunteers Build the Internet

In 1991, Linus Torvalds announced a free, modifiable operating system kernel and invited contributions from anyone online. That hobby project became Linux, built by volunteers outside corporate hierarchies and restrictive licenses, and now runs on billions of computers, including most supercomputers, Internet servers, and smartphones. Linux’s success challenged conventional proprietary software development by showing that collaborative, non-hierarchical volunteer production could produce high-quality, widely adopted software.

MoofTCP – A modern replacement for MacTCP on 68k Macs

MoofTCP is a memory-lean, drop-in replacement for Apple’s MacTCP on 68k Macs running System 6, implementing the MacTCP driver and name resolver interfaces so existing programs run unchanged. It uses a fresh TCP/IP stack written in portable C and adds its own installer, control panel, DHCP client, and a Lite build that saves about 5 KB by omitting DHCP. It aims for reliability, low latency, and throughput while using no more resident memory than MacTCP.

Practical guide on out of tree mitigations on Linux

The article is a practical guide to implementing out-of-tree security mitigations on Linux, assuming systemd-based service management. It emphasizes the core principle of treating programs as potentially malicious and limiting what they can access, arguing that a hardened allocator is the most important single mitigation. It recommends hardened_malloc by default, with mimalloc in secure configuration and scudo as alternatives.

📈 Tech Business & Policy

When the Watchdogs Are Silenced: India’s Crackdown on Those Documenting Online Censorship

On November 3, the Delhi Police issued takedown requests through X targeting 42 URLs, including accounts and posts belonging to SFLC.in, the Internet Freedom Foundation, and @geoblockedindia, as well as posts documenting online censorship. The requests cite hate speech, alleged defamation of the RSS, and safety concerns, but target groups that document government restrictions on online expression, threatening public transparency about censorship in India.

NHS wants a second opinion on Palantir’s glowing self-assessments

The NHS has told Palantir to clear its claimed benefits with health chiefs, seeking a second opinion on the supplier’s self-assessments. Enforcing that approval requirement could prove difficult.

Britain’s tech ambitions depend on minerals made in China, MPs warn

MPs warned that Britain’s tech ambitions depend on minerals made in China, and a committee could not confidently confirm that any of the government’s ten supply-security tests have been met. It said alternative supplies are around a decade away.

App Store 2026 in numbers: AI, pricing, abandoned apps

An analysis of 178,637 apps in App Store top charts across 173 countries found that 9.8% mention AI in their listings, rising to 43% in Graphics & Design and nearly tripling among apps selling in-app purchases or subscriptions (19.9% vs. 6.6%). Among free apps, 26.7% offer in-app purchases or subscriptions, while 20.3% have not been updated in a year or more. Subscription and price complaints were the most common issue in 1–2 star reviews at 12.7%.

Budget offers $50B jolt to help Canada double its electricity grid

Canada’s Budget 2026 proposes more than $50 billion in measures to expand the electricity system and help double the grid by 2050, largely through extended clean electricity and clean technology tax credits, transmission, nuclear, and renewables funding. It includes $52 billion in new electrification commitments within $115 billion in total spending through 2041-42, plus $587 million over five years for EV chargers. Much of the funding is scheduled for later decades, raising concerns about long-term certainty and slow scale-up.

Silicon Valley’s Bad Night

The provided article contains no news reporting; it only displays a Cloudflare security-check message asking users to wait while their connection is confirmed. No details about Silicon Valley or the reported “bad night” are available.

Tesla and SpaceX lose over $420B in combined market cap in the two days

Tesla and SpaceX shares fell sharply after Democratic midterm gains, including in Texas and Congress, wiping more than $420 billion from their combined market value over two days. The drop also cut Elon Musk’s personal wealth by about $189 billion, as markets weighed increased regulatory risks for his businesses.

Sources: Democrats eye Apple, Meta, Musk firms as early probes after House, Senate wins

Democrats, after winning House and Senate majorities, are preparing congressional investigations targeting major companies including Apple, Meta, and Elon Musk-led firms. The probes would examine sensitive and controversial corporate actions from the past two years, prompting executives who had courted the Trump administration to brace for scrutiny.

Sources: Nvidia requires SE Asian cloud partner applicants to track AI chip locations

Nvidia is increasing monitoring of AI accelerators sold in Southeast Asia to curb semiconductor smuggling after criticism that it has not done enough to stop illegal shipments reaching Chinese companies. The chipmaker now requires regional customers to enroll in its fleet intelligence system, which tracks AI accelerator locations, to become official Nvidia Cloud Partners.

Musk: Tesla to wind down Texas Cybertruck output in mid-2027 for Cybercab production

Elon Musk said Tesla plans to wind down Cybertruck production at its Texas Gigafactory in mid-2027 to make room for increased Cybercab output. The Financial Times reports that the carmaker will phase out production of the futuristic pickup at the plant.

~40% of planned data center capacity is in states where new governors pledge to pause construction

About 40% of planned US data center capacity is in states whose newly elected governors pledged to pause or halt construction, according to Bloomberg. The midterm results shifted the regulatory landscape against the AI buildout, with governors-elect in Ohio, Georgia, Michigan, New Mexico and Texas campaigning on stopping or pausing projects and leaders in New York and Oregon seeking to extend existing pauses.

Potential Sciences chemical-data AI startup gets UK Sovereign AI Fund backing in eight-figure raise

Potential Sciences, a UK startup building large-scale chemical datasets through physics-based simulations, has secured backing from the UK government’s Sovereign AI Fund as part of an eight-figure seed raise. The startup says it will use the data to train AI models that can predict how drug candidates interact with human biology, aiming to speed drug discovery and reduce costly lab experimentation. It launched on November 5 with funding from SovAI and Twin Path Ventures, among others.

Monzo eyes ~£7.5B funding round after Nu deal fails, stake sale struggle

UK neobank Monzo is exploring a new fundraising round that would value it at about £7.5 billion, according to sources. The move follows its failure to secure a £10 billion takeover by Brazilian fintech Nubank and difficulties selling a stake. Monzo had shifted focus to talks with buyout groups after the Nubank deal fell through.

Filing: Airbnb has option to invest in, license tech from CEO Chesky’s stealth AI lab

Airbnb disclosed in a filing that it has the option to invest in and license technology from a stealth AI lab controlled by CEO Brian Chesky. Chesky has self-funded the secretive startup so far, according to The Information.

Sources: Thinking Machines raising $5B led by Accel at $40B pre-money, more than tripling valuation

Thinking Machines Lab is raising $5 billion led by Accel at a $40 billion pre-money valuation, with the round expected to close as soon as this week. The deal would more than triple the AI startup’s valuation from its last public round last year.

Lyft Q3 revenue up 8% to $1.82B, misses estimates; net loss $0.03/share; stock drops 8% after hours

Lyft reported Q3 revenue up 8% YoY to $1.82B, missing estimates of $1.92B, and a net loss of $0.03 per share versus an expected profit of $0.20. Shares fell more than 8% after hours. Results were dented by legal, tax and regulatory reserve changes and settlements, even as bookings rose and rides and riders hit all-time highs.

Meta indefinitely pauses new commercial terms over scraping, publisher outcry, court injunctions

Meta has indefinitely paused proposed commercial terms that critics said would allow it to scrape the websites of Meta Business account users. The delay follows publisher outcry and preliminary injunctions in Norway and Brazil, and Meta says it will continue consulting stakeholders while existing terms remain in effect. The terms had already been postponed and revised amid bipartisan U.S. concern and a UK competition investigation.

Cloud security startup Cyera plans ~$800M raise led by Cyberstarts at $20B valuation, up from $12B

Cyera, a five-year-old cloud security startup, is planning to raise about $800 million in a round led by Cyberstarts at a $20 billion valuation, according to sources. The reported valuation is up from $12 billion in June.

Major investors skeptical Anthropic IPO can hit $1.5T after selloff; one sees $1T

Major investors are increasingly skeptical that Anthropic’s upcoming IPO can achieve a $1.5 trillion valuation after an AI-related market selloff, with one source suggesting it could be closer to $1 trillion. Anthropic is aiming to hold the IPO the week before Thanksgiving and has been expected to raise up to $100 billion.

💻 Platforms & Infrastructure

Safari’s Autofill feature may be distoring time

Safari’s Autofill feature may be distorting time, according to repeated reports about inaccurate form filling that have lingered for years. The available article provides no further specifics beyond that claim.

Kugelblitz – Mac-Native Google Earth Alternative

Kugelblitz is a Mac-native Google Earth alternative that renders Earth and other bodies as a 3D globe and atlas using free open geodata, including OpenStreetMap, imagery, road and topographic maps on real terrain. It offers a library of global map services, 3D buildings, smooth navigation even on M1 Macs, and optional Vision Pro viewing without a headset app. No account is required, and loaded map data is cached and can be shared across instances on the same network.

Nvidia Kubernetes Engine (NVKE)

NVIDIA Kubernetes Engine (NVKE) is a preview managed Kubernetes service that platform teams install on their own NVIDIA GPU infrastructure to create and operate customer workload clusters. Each workload cluster has its own Kubernetes control plane, etcd, and node pools, with machines provisioned through NVIDIA Infra Controller (NICo). NVKE is not recommended for production workloads, and a local quickstart allows evaluation without GPU hardware using simulated machines.

No Intel, no Qualcomm: Huawei unveils its first ‘100% domestic’ desktop

Huawei has launched its first desktop computer powered by its proprietary HarmonyOS, the Qinyun HM650 series, targeting enterprise and government users. The company says the device uses entirely China-made components, including its self-developed Kirin X90 processor, and is certified as “100 per cent domestic,” though the certification’s exact scope is unclear.

🎲 Offbeat & Culture

Hospital gave very sick doctor a special PC for his personal, erm, pleasure

A hospital gave a seriously ill doctor a special PC for personal pleasure, and an IT support worker was told to either allow the blatant policy violations or find a new job. The support technician’s account centers on being forced to choose between complicity and unemployment.

Ants trapped for years in Soviet bunker; survival by cannibalism (2016)

A colony of ants was found trapped for years in a former Soviet bunker and survived by cannibalism. The 2016 research article documented the isolated ants’ reliance on eating their own kind to persist in the bunker.

Multiplayer tanks that demolish real buildings from OpenStreetMap

A multiplayer tank game lets players drive through real cities based on OpenStreetMap, destroy buildings, and have that destruction persist for all players. Players can battle other tanks, defend streets, and spray marks on rubble using WASD to drive, a mouse to aim, and clicking to fire.

How accurately did science fiction stories predict AI?

The article examines how accurately science fiction predicted AI development, concluding that most stories missed how systems like transformers would be built and scaled. It ranks Ted Chiang’s “The Lifecycle of Software Objects” highest for its focus on teaching, maintaining, and selling AI, while noting that no pre-2017 work clearly predicted the transformer attention mechanism or the rapid shift from chatbots to capable agents. It also endorses Ursula K. Le Guin’s view that science fiction is descriptive rather than predictive.

What are you doing this weekend?

The article invites readers to share their weekend plans and to ask for help or feedback. It also emphasizes that doing nothing at all over the weekend is perfectly acceptable.