News
News
What the companies announced, what is only reported, and what it changes if you are about to buy.
Top story
More news
Self-hosting GitLab? Alpine Linux shows the CVSS 10 regex fix also needs a Ruby update
Alpine Linux rebuilt its GitLab server from scratch and reset every password after an attacker probed CVE-2026-97229, a CVSS 10 flaw in the Ruby regex engine GitLab uses for CI configs. Alpine had upgraded GitLab, but its image lacked the Ruby patch. Fixed Ruby versions are 3.3.13, 3.4.12 and 4.0.9.
Apple Watch showing the wrong hour after the time change? Switch faces or restart it, and your alarms are fine
US clocks went back on November 1, and some Apple Watches now show a time one hour off on the Always On display while the wrist is down. Apple's support page says alarms are not affected, and the fix is to switch watch faces and back, restart the watch, or wait until midnight.
ChatGPT Pro 100 and Pro 500 now get twice the Work and Codex usage, and the Pro 200 cut is canceled
OpenAI doubled the Work and Codex allowances on its $100 Pro 100 and $500 Pro 500 plans on October 29 and dropped the planned usage cut for $200 Pro 200 subscribers. Prices did not change. Next, OpenAI plans to fold Work into regular Chat and draw ChatGPT and Codex from one shared allowance.
Logitech's MX Master 4 Developer Edition costs the same $119.99 as the regular mouse, and only the look changes
Logitech sells the MX Master 4 Special Edition in a developer-themed finish for $119.99 in the US, the same price as the standard Graphite model. The hardware is unchanged: 8,000 DPI sensor, MagSpeed wheel, haptic panel. Logitech calls it a limited drop.
LXD and MicroCloud have a CVSS 10 login bypass. Update the snaps and close the API to the internet
Canonical says CVE-2026-112816 lets an attacker log in to the LXD or MicroCloud API as a trusted client without its private key, and possibly reach root on the host. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5. There is no workaround.
A hijacked speed-monitoring script drained Polymarket accounts. Check the third-party code on your signed-in pages.
On October 29 a DebugBear page-speed script on Polymarket was swapped for code that sold traders' positions and moved the funds out. Polymarket is refunding $2.7 million to drained wallets and $3.9 million in total. DebugBear says its DNS was hijacked through its domain registrar. Here is what a team running any signed-in web app should check.
VOLTA malware asks an AI model what each victim is worth. Your browser cookies are what it values
Cisco Talos found VOLTA, a Windows infostealer that sends a profile of each victim to an AI model through OpenRouter, with Claude Opus 4.6 as the default and Kimi K2 or Gemini 2.5 Flash as fallbacks, to rank what to sell first. It takes browser cookies, Slack and Discord sessions, SSH keys and crypto wallets.
One silent text can crash an unpatched Android phone and drop its calls. Check for the October 2026 security patch.
A malformed WAP Push text, CVE-2026-58882, crashes Android's phone service with no tap and no visible message, dropping calls and in some cases looping reboots. Google's October 2026 update fixes Android 14 to 17. Android 12 and 13 phones stay exposed, and exploit code is public.
Arrowmax Arrowspace S1: can AI make precision repairs easier?
Arrowmax's Arrowspace S1 is a Kickstarter precision driver with a rear camera that identifies the screw, lights the matching bit in a 52-bit case and sets a starting torque. Early pledges start at $119, with delivery estimated for April 2027. Here is what the design solves and what still needs testing.
Google Cloud spend caps are now generally available. They can stop a runaway Gemini API bill, with limits.
Google Cloud's spend caps, generally available since October 30, pause new Gemini API, Vertex AI and Cloud Run usage in a project once a monthly budget is hit. They don't stop Compute Engine or storage, they can overshoot, and you pay any overage.
Intel expects its PC chip sales to fall more than 20% this quarter. It is moving factory capacity to server chips.
Intel's Q3 2026 results: PC chip revenue fell 5% to $8.1 billion while data center revenue rose 78% to $7.3 billion. Intel expects PC chip revenue to drop more than 20% this quarter, blames memory prices, and is converting laptop-chip wafer capacity in Oregon to server production.
Hijacked Shopify apps sent shoppers to fake payment pages. Test your store's checkout today.
Attackers abused the vendors behind Hulk Product Options, Selleasy and Swym Wishlist Plus in October to redirect Shopify shoppers to lookalike payment pages that collected card details. Seiko pulled the Swym app from its Japanese stores on October 30. If you sell on Shopify, run a checkout test and check your apps.
TeamViewer 15.83 fixes a flaw that lets the computer you connect to attack yours. Update every client and host.
TeamViewer bulletin TV-2026-1011 fixes three high-severity flaws in its clients, including CVE-2026-111585, where a malicious or compromised host can crash the viewer and, on Windows, run code on it. Version 15.82 from September is still affected. There is no workaround: update to 15.83.
A backdoored Claude Code extension sat in Cursor's marketplace for 11 hours. One command tells you if you were hit.
Malicious versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension went out through Cursor's extension marketplace on October 29 and planted an SSH key and a persistent tunnel on Macs and Windows PCs. Cursor has pulled them and published a check and cleanup scripts. Anthropic hasn't explained how its account was used.
OpenAI, Google, Microsoft and Anthropic will honor one robots.txt line that opts your site out of AI training
A new IETF draft written at Anthropic defines a shared robots.txt token, __usage_ai-training, that tells participating AI companies not to train on your pages. Anthropic already honors it, Microsoft starts February 1, 2027, Google plans to in 2027 and OpenAI in the coming months. It covers training only.
Anthropic renames Claude Max 20x to Ultra and drops the 5-hour limit for verified accounts
Claude's $100 Max 5x plan is now Max and the $200 Max 20x plan is now Ultra. Prices don't change. Ultra loses the rolling 5-hour cap once Anthropic verifies the account, and both plans now include monthly API credits equal to their price. The weekly limit still applies.
Google announces Gemini 4 Carbon, but only security defenders can use it for now
Google announced Gemini 4 Carbon on October 28 with API pricing of $2 and $10 per million tokens at launch. Access is limited to cyber defenders. What it costs and what to do before it reaches your plan.
Apple's touchscreen OLED MacBook Pro starts at $2,899, $400 more than the model it sits above
Apple announced the first touchscreen Mac on October 28: a MacBook Pro with a tandem OLED display, M5 Pro or M5 Max, from $2,899 for 14 inches and $3,399 for 16. Pre-orders are open and it ships November 6.
XREAL Aura, the first Android XR glasses, opens pre-orders at $1,099 to $1,499 and ships mid-November
XREAL Aura pre-orders opened October 28 in the US at $1,279 and $1,499, or $1,099 and $1,299 with a launch offer through December. The glasses run Android XR and pair with a belt-clip puck. Release is mid-November.
Keynote, Pages and Numbers will let outside AI agents edit your files in November. Don't pay $12.99 a month for that yet.
Apple's November Creator Studio update adds Model Context Protocol support to Keynote, Pages and Numbers on macOS 27, so external AI agents can read, edit and automate documents. Creator Studio costs $12.99 a month or $129 a year. Apple hasn't said whether MCP needs the subscription.
Also today
Short items, bundled by day.- Nov 1, 20262 short items: Aramco closes its deal for 49% of Saudi AI company Humain, with $2.6 billion in cash · FBI blames North Korea's TraderTraitor for the $6.43 billion Binance hack
- Oct 30, 20262 short items: Gemini now builds slide decks, Sheets and PDFs inside the chat, on free Google accounts too. Decks export as PPTX. · Local Code is a free, open-source AI agent that runs on your Mac. The small model needs 16GB of memory.
- Oct 29, 20261 short item: Samsung's upgraded sleep apnea detection reaches Galaxy Watch and Ring in November
- Oct 28, 20264 short items: ChatGPT can now read and send your iCloud Mail and edit your iCloud Calendar · Apple raised the MacBook Neo's education price to $649. The general price is $699. · Samsung's open-ear Galaxy Buds On cost $229 in the US and ship in early November · SK Hynix says memory demand will outrun supply through 2030, so expect Mac and PC prices to stay high
- Oct 27, 20261 short item: Ollama now reads text aloud on Apple silicon Macs, offline, with free Phonon voice models. Check the license before you ship with them.
- Oct 26, 20263 short items: Even Realities G2 update adds a Knowledge Base for meeting notes, plus a $649 tortoiseshell frame. · OpenAI's GPT-6.1 Terra halves the price of its mid-size model and reaches ChatGPT and Codex today. · Apple blocks eight compromised web certificates on Macs, but curl and git still trust them
- Oct 25, 20262 short items: Apollo's chief economist says AI hasn't paid off for companies outside big tech yet · Teams will flag phishing in chats from outside your company starting in November
- Oct 22, 20265 short items: Anker's 13-in-1 Nano dock is $119.99 on Amazon, and the posts calling that a record low are wrong. It was $104.99 on October 4. · Apple put an Intelligent Assistant in Pages, Keynote and Numbers, and it is only for Apple Creator Studio subscribers. · Google Meet will draft the follow-up email and file the action items for you. · Google Meet calls now use post-quantum encryption on laptops and room hardware. · Microsoft Teams gets deepfake warnings in November, but Microsoft is not the one doing the detecting.