Data center backlash is set to intensify after Democrats’ November 3 wins
The November 3 midterm results gave Democrats full…
Updated 3 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
OpenAI pipeline produced 948 Linux root exploits in a 30-hour run
OpenAI detailed a prototype pipeline that used an upcoming cyber-focused artificial intelligence model to validate and patch 948 local privilege escalation vulnerabilities in Linux. The company said the run cost $1.2 million in API costs and that the work produced working exploits that could let a low-privileged local user reach root access. The pipeline and its five stages OpenAI described the process as an agentic pipeline with five stages. It…
Citrix XenServer vulnerability needs management network access
Citrix has disclosed a critical XenServer vulnerability that could let an unauthenticated attacker compromise virtualization hosts and supporting appliances. Tracked as CVE-2026-98432, the flaw requires access to the management network, which limits which systems are exposed. XenServer releases and affected appliances The November 3 security bulletin covers XenServer 8.4 and XenServer 9, along with affected Workload Balancing and Conversion Manager appliances. Citrix researchers said the issue could compromise the host,…
Snapchat+ subscriptions top 30 million as Snap expands paid tiers
Snap has passed 30 million paid Snapchat+ subscribers, according to its third-quarter 2026 earnings release on Wednesday. The total is up by 5 million since February, when the company said it had crossed 25 million. Snap said paid subscribers span Snapchat+, Memories Storage, and Lens+. Snapchat+ launched in 2022 and gives subscribers exclusive and pre-release features for $3.99 per month. Snap later added more paid tiers beyond the core subscription…
AI PACs lost key 2026 races despite spending millions
Political groups on both sides of the AI debate spent millions of dollars trying to influence Tuesday’s midterm elections and shape future AI regulation. The spending produced mixed results, and some of the most heavily backed candidates lost their races. AI-focused political action committees, or PACs, poured money into candidates, while groups backing stronger AI safeguards also spent heavily. The contests also exposed a larger argument over whether Congress should…
Debian and Ubuntu APT flaw enables root code execution in package retries
A flaw in APT affects Debian and Ubuntu package downloads when an attacker can alter traffic between the package manager and the package server. The issue lets a checked package be replaced during a retry, and the attacker’s code can run as root. Advisories from Debian, Ubuntu, and APT’s developers were published on November 4. APT retries failed downloads by default from Debian 12 and Ubuntu 22.04 onward, which creates…
Rails Active Storage flaw can expose server secrets through crafted uploads
A critical flaw in Ruby on Rails Active Storage can let an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can also make the server read files. The Rails team rated the bug Critical, gave it a CVSS score of 9.8, and published the advisory on November 4, 2026. ImageMagick behavior behind the flaw The issue starts…
APT29 campaign uses n-day flaws to target iOS and Android devices
A watering hole campaign tied with moderate-to-high confidence to APT29 has been hitting iOS and Android users who visit compromised websites or fake portals that imitate legitimate ones. Researchers at cybersecurity company Sekoia traced the activity to pages and domains that profiled visitors, selected exploit chains by browser version, and delivered payloads without user interaction. Apple and Google have already patched the flaws used in the campaign. The report says…
Cloudflare’s Zero Wire tracks critical CVEs and security fixes
Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes. Announced on November 3, 2026, it sits within Cloudflare Radar’s security section and brings technical evidence, vendor guidance, and recommended actions into readable briefings. The service is built around a familiar problem. When a serious vulnerability appears, defenders have to assemble scattered advisories while checking…
Chrome 157 closes 213 security holes across Windows, macOS, and Linux
Google has released Chrome 157 for Windows, macOS, and Linux, and the update fixes 213 security bugs, including seven that are rated critical. The stable release will reach users over the coming days and weeks, and the patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. Seven critical flaws in browser graphics code Two of the critical vulnerabilities are buffer overflows in Dawn, Chrome’s implementation of the…
Google’s November Android update fixes zero-click RCE flaws
Google’s November 2026 Android security update addresses more than 200 vulnerabilities across the operating system, kernel, and hardware components. Published on November 2, the bulletin includes critical remote code execution flaws that require no user interaction, and devices with security patch level 2026-11-05 or later receive all applicable fixes. Android update flaws span Framework, System, kernel, and hardware The most serious Framework issue, CVE-2026-58868, could allow remote code execution without…
Microsoft Edge tightens scam notification blocking
Microsoft Edge now automatically disables notifications from websites that send users to detected scam pages, closing one route used for fake virus warnings. The change reached Edge 156, according to Microsoft’s November 2 disclosure, and it works with Microsoft Defender SmartScreen and Scareware blocker detections. The browser can now stop further notifications from the site that led a user to a scam page. Microsoft said closing the deceptive page alone…
Google patches an Android flaw that can run code without user action
A critical Android flaw could let an attacker run code on a phone remotely without any user action, according to Google’s November security bulletin. The flaw is CVE-2026-58868, and Google says it affects Android 14 through 17. Security patch level 2026-11-01 or later includes the fix for CVE-2026-58868. Phone makers and carriers deliver that update on their own schedules, and Google says older versions such as Android 12 and 13…