Daily News Digest — 2026-10-09

Today's digest

Security dominated the day. BleepingComputer covered a Citrix NetScaler remote-code-execution flaw, five critical Cisco Nexus flaws, an FBI takedown of Flax Typhoon infrastructure, a ransomware attack on Japan's IDCF Cloud, and a firmware-level Android malware campaign. The Pwn2Own Ireland contest ended with $1.26 million paid for 98 zero-days.

In tech policy and business, the US suspended Microsoft, Adobe, Infosys, Tata, Wipro and other firms from the green-card labor certification program (Slashdot). Digg led with the FT report that OpenAI's annualized revenue is near $50 billion rather than the roughly $70 billion widely reported, and with SpaceX's FCC approval and spectrum purchase, which hit US carrier shares. Slashdot also marked the death of Apollo software pioneer Margaret Hamilton and the first working thorium nuclear clocks. Digg's remaining stories were mostly entertainment, sports and gaming.

Overlap across sites: Microsoft features on both Slashdot (green-card suspension) and BleepingComputer (Windows update certificates, Teams deepfake detection); no story was covered in full by more than one site.

Must-read stories:

• Citrix warns admins to patch a new critical NetScaler RCE flaw immediately (BleepingComputer)
• FBI disrupts Chinese hacking tools used to breach critical infrastructure (BleepingComputer)
• US bars Microsoft, Adobe, and major IT firms from the green card program (Slashdot)
• OpenAI's annualized revenue reportedly about $20 billion below what it had signaled (Digg)
• Apollo software pioneer Margaret Hamilton dies at 90 (Slashdot)

Slashdot

A 1960 Paper Published In Science Predicts World Will End Next Month

A 1960 Science paper by Heinz von Foerster and two University of Illinois colleagues, titled "Doomsday: Friday, 13 November, A.D. 2026," extrapolated shrinking population doubling times to predict human population would approach infinity around that date. The formula's result was 2026.87 plus or minus 5.5 years, and the Friday-the-13th date was chosen somewhat arbitrarily. Demographers rejected it at the time, noting for example that doubling time cannot fall below the nine months of human gestation, and Science's own response said the forecast would set a record for how quickly it was shown to be unreliable.

Apollo Software Pioneer Margaret Hamilton Dies at 90

Margaret Hamilton, who helped establish software engineering as a discipline and whose code helped land Apollo astronauts on the moon, has died at 90, according to MIT News. She worked at MIT from 1959 until the mid-1970s, authored more than 130 publications, later became an entrepreneur and CEO, and received the 2016 Presidential Medal of Freedom. MIT's Olivier de Weck called her a fundamental contributor to Apollo's success.

First Thorium Nuclear Clocks Begin to Tick

Researchers in Vienna and Beijing have independently built the first nuclear clocks based on oscillations inside thorium nuclei, with results published in Nature. The clocks lose about a second over millions of years, far short of the best atomic clocks, which are roughly 10,000 times more reliable. Proponents say nuclear clocks could become more portable and more reliable over time, and could help search for dark matter.

US Bars Microsoft, Adobe, and Major IT Firms From Green Card Program

The Trump administration is suspending Microsoft, Adobe, Capgemini, Cognizant, HCL, Infosys, Tata and Wipro from a program that helps skilled foreign workers obtain permanent residency, accusing the companies of fraud. Labor Secretary Keith Sonderling said no new or pending permanent labor certification applications involving these firms will be accepted, and Vice President JD Vance said nine universities, including Harvard, Yale and Stanford, will be investigated over student-visa program abuse. Microsoft said about 80% of its roughly 6,000 H-1B applications last fiscal year were to extend or change the status of existing employees.

Emmy Awards Leave Broadcast TV For Prime Video

Amazon Prime Video will become the exclusive global home of the Emmy Awards under a six-year deal starting in 2027, the Television Academy announced. The show will stream live for free in more than 240 countries and territories without a Prime subscription. It ends the rotating arrangement among ABC, CBS, NBC and Fox that has been in place since at least 1994.

Female AI Agents 'Paid' Less Than Males, Study Finds

A University of Limerick study with 189 participants in a VR office setting found that AI agents presenting as male were paid about 10% more per task and seen as more human-like than agents presenting as female, even though both used the same underlying technology. The submitter notes the sample is small.

Digg

Marvel Television's 'Zodiac' is coming to Disney+ in 2028

Variety describes Zodiac as a live-action spy thriller set to begin filming in London in spring 2027, with a Disney+ release in 2028.

Guardians beat White Sox 9-5 to force winner-take-all ALDS Game 5 in Cleveland

José Ramírez and Patrick Bailey homered as Cleveland won 9-5. Saturday's Game 5 winner earns an ALCS berth.

Paramount reportedly has a live-action Cyberpunk 2077 movie in development

Deadline reported that Paramount Pictures is developing a live-action film set in the Cyberpunk 2077 universe, with Lorenzo di Bonaventura attached to produce.

OpenAI's annualized revenue reportedly about $20 billion below what it had signaled

The Financial Times reports OpenAI told investors its annualized revenue was approaching $50 billion in September, compared with a widely reported $70 billion. MarketWatch noted the Nasdaq touched session lows after the report.

'Crazy Rich Asians' HBO Max Sequel Series Teaser Drops with Four Original Cast Members Returning

PopBase says Constance Wu, Henry Golding, Ronny Chieng and Michelle Yeoh will reprise their roles in the HBO Max sequel series. Production begins in 2027 (from feed excerpt).

SpaceX gains FCC approval for 15,000-satellite constellation and agrees to acquire 800 MHz spectrum

SpaceX announced it will acquire 800 MHz spectrum that could improve Starlink indoor coverage and support its mobile ambitions. The spectrum agreement still needs FCC approval.

Buccaneers beat Cowboys 24-16 for first win of 2026

The NFL says Bucky Irving totaled 175 yards and two touchdowns in Tampa Bay's Thursday-night victory.

An earlier remark about being allowed to criticize OpenAI gets an 'aged like milk' follow-up

A social-media user had said they were unhappy with much of what OpenAI does but glad they were allowed to say so. A follow-up post drew attention for how the remark aged (from feed excerpt).

SpaceX spectrum deal hits shares of AT&T, Verizon and T-Mobile

CNBC reports SpaceX agreed to buy a nationwide spectrum portfolio as it pushes Starlink deeper into US telecommunications, weighing on shares of the three big US carriers.

Three Marvel Zombies annual specials planned for 2027 through 2029

Three specials were revealed at NYCC: The Winter Soldier, The Fist of Khonshu and The Last Guardian.

A'ja Wilson wins record fifth WNBA MVP award

The WNBA says Wilson averaged 26.2 points, 9.4 rebounds and 3.2 assists while leading the league in scoring.

Xbox creates XP division for film, products and live experiences

Xbox says former Mojang president Kayleen Walters will lead XP, aligning work from existing teams under one mission.

Crew-12 splashes down off California, ending its science mission

NASA said the Crew-12 SpaceX Dragon spacecraft completed its deorbit burn and was retrieved from the Pacific, ending the mission.

GTA 6 reveals radio stations including Vice City's Flash FM

Rockstar promises the series' biggest in-game radio selection yet. Eurogamer says players can listen outside cars with headphones.

Netflix reportedly preparing to cut about 5% of its workforce

Puck estimates a 5% cut would amount to about 850 jobs. A Netflix representative declined to comment.

Everton reportedly put up for sale by The Friedkin Group

The Athletic's David Ornstein reports the owners would exit for the right buyer but intend to support Everton in the meantime.

Tesla AI reportedly renamed Tesla SI (Super Intelligence)

A user calls the name change official and tags @TeslaSI in the post (from feed excerpt).

Malaysia proposes $112.5 billion budget for 2027 ahead of possible election

Reuters reports the 459.8 billion-ringgit proposal would raise spending despite fiscal pressure from rising global oil prices.

'Lanterns' finale draws 10.5 million global viewers in its first three days

Deadline reports the HBO season finale set a new audience record for the series.

Russell moves to P1 on soft tyres with 10 minutes left at Singapore GP

F1 says Russell had soft tyres fitted to his Mercedes when he took the top spot in practice.

BleepingComputer

Microsoft: Outdated Windows devices will stop receiving security updates

Microsoft says devices on unsupported Windows versions will lose access to Windows Update after certificates expire on May 17 and June 19, 2027. Windows 11 25H2 and later need no action; 24H2 and Server 2025 need the September 2025 update or later, and other supported versions need the July 2026 update or later before June 19, 2027.

Citrix warns admins to patch new NetScaler RCE flaw immediately

CVE-2026-107406 is a memory overflow in NetScaler ADC and Gateway that allows remote code execution or denial of service on appliances configured as a SAML IdP or SP. Citrix is not aware of unmitigated exploits and urges upgrading to 14.1-73.46, 13.1-64.29 or later. Shadowserver tracks over 21,000 exposed NetScaler IPs.

Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland

Pwn2Own Ireland 2026 ended with $1,262,000 paid for 98 zero-days. Ikotas Labs won with 42.5 Master of Pwn points and $361,000, including the $300,000 top prize for chaining zero-days against the Google Pixel 10. Xint placed second with $240,000 and Team ZyGoat third with $125,000; the Galaxy S26 was hacked repeatedly.

FBI disrupts Chinese hacking tools used to breach critical infrastructure

The FBI seized seven domains used by the Flax Typhoon group to run two tools, MicroScan and FishHub, which were developed by China-based Integrity Technology Group. MicroScan scanned for vulnerabilities alongside a Mirai-infected botnet. The FBI says the Chinese government relies on contractors to expand its cyber operations.

Ransomware attack disrupts Japan's IDCF Cloud used by govt clients

IDC Frontier, a SoftBank subsidiary, said a ransomware attack beginning October 7 at 3:40 AM local time caused an outage in its East Japan Region 1 data center cluster, affecting 495 companies and local governments. The company isolated systems and disabled customer management-console access in all regions while it checks their security.

Low-cost Android phones ship with residential proxy malware

Bitdefender found a firmware-level campaign called Midnight Mimosa on low-cost MediaTek-based Android phones, including the Doogee S200 X and Cubot KINGKONG X. It affected thousands of devices in more than 150 countries over about two years, silently installing apps, committing ad fraud and turning devices into residential proxies. The responsible party and point of tampering remain unknown.

FakeGit malware campaign returns with 17,610 malicious GitHub repos

Apiiro reports FakeGit resumed on October 4 and now uses 17,610 GitHub repositories to distribute SmartLoader, which pushes the StealC infostealer. More than 13,000 repos were pushed in 34 hours, and at least 700 accounts appear to belong to legitimate developers. In sampled commits, 97% touched only the README and 88% pointed the download button at a malicious ZIP.

Cisco warns of critical flaws allowing Nexus switch takeover

Cisco published advisories for five critical NX-OS vulnerabilities that can give root-level code execution on Nexus 3000 and 9000 switches in standalone NX-OS mode, or crash and reload devices. Exploitation requires the NX-API, NGOAM or MPLS OAM features to be enabled; NX-API is disabled by default.

OAuth grants pile up faster than you can review them. Here's how to keep up.

This sponsored article from Nudge Security argues OAuth grants are separate from SSO and MFA, outlast the credentials of the users who create them, and can sit dormant while staying valid. It cites the recent Klue breach as an example of attackers exploiting forgotten grants.

Uranium crypto exchange hacker convicted for stealing $53 million

Maryland man Jonathan Spalletta was found guilty of stealing about $53.3 million from the Uranium Finance exchange on BNB Chain in two April 2021 hacks, the second of which forced it to shut down. He also extorted a sham bug bounty of about $386,000 after the first hack and laundered the funds through Tornado Cash and decentralized exchanges.

Microsoft Teams to get support for third-party deepfake detection tools

Microsoft's 365 Roadmap shows Teams will integrate detection signals from certified third-party deepfake providers and add an impersonation protection feature that warns users about suspicious meeting participants. Both are due for general availability in November.

ASOS links data breach to social engineering attack, credential theft

ASOS says an attacker impersonated a trusted contact to obtain an employee's login credentials and used them to access third-party platforms. A group calling itself "Xuanye Group" sent malicious in-app notifications to customers on October 6 claiming data theft. ASOS confirmed that some basic personal and contact details may have been exposed, but not payment information.