Daily News Digest — 2026-10-15

Today's digest

Security and AI dominate the day. Several actively exploited zero-days were patched in enterprise gear (Palo Alto PAN-OS, Cisco Secure Email Gateway, Ivanti Connect Secure), a Ledger hardware-wallet supply-chain tampering case widened across Asia and Europe, and law enforcement acted against a North Korean IT-worker laptop-farm scheme and a Chinese-language phishing marketplace tied to over a billion messages. Microsoft also shipped October Patch Tuesday fixes for Windows 11 black-screen and Always On VPN bugs.

On the AI side, eight US states sued OpenAI over ChatGPT's effects on young users, Bank of America said it hired 1,000 contractors to patch code flaws exposed by advanced AI models such as Anthropic's Mythos, and Anthropic's warning that small models could self-replicate across IoT devices was covered by Slashdot (and by BleepingComputer a day earlier). Digg's front page was led by entertainment, sports and product news: the Brewers' 3-0 NLCS lead, Real Madrid's comeback, the Xbox Nano Controller, TSMC's record quarter, and a Citizen Lab report on zero-click spyware delivered through ads to Al Jazeera devices. Other tech-policy threads include Netflix's layoffs, the Dutch tax agency dropping Microsoft 365 in favor of open source, and the CCIA's cost warning on EU data sovereignty rules.

Must-read stories:

• Ivanti Connect Secure authentication bypass exploited as a zero-day since early October, with CISA urging immediate patching (BleepingComputer)
• Ledger asks Asian resellers to halt sales after hardware implants were found stealing seed phrases (BleepingComputer)
• Eight US states sue OpenAI, claiming ChatGPT harms young users (Slashdot)
• Anthropic warns small AI models could self-replicate through IoT devices (Slashdot)
• Zero-click spyware reportedly targeted 45 Al Jazeera devices through ads (Digg)

Slashdot

Bank of America Hired 1,000 Contractors to Patch Software Flaws Exposed By Anthropic's Mythos

Bank of America put 1,000 outside contractors to work on patching vulnerabilities exposed by advanced AI models, including Anthropic's Mythos, and they remain on the job alongside about 3,000 in-house staff in that area. CEO Brian Moynihan told CNBC the bank spent a "couple hundred million plus" in the third quarter on this remediation and on anti-money-laundering compliance issues. (from feed excerpt)

Mini Organs Launching to Space For Study On Aging

Researchers from Mount Sinai, NASA and Space Tango launched miniature human hearts and brains to the International Space Station on the CRS-35 resupply mission to study how microgravity and radiation affect organs and may accelerate aging. Up to 16 mini hearts will be housed in Space Tango's shoebox-sized CubeLab, and researchers say six months in space is roughly equivalent to 10 to 20 years of aging on Earth. (from feed excerpt)

Schools Across US Protest FCC Plan That Could Disconnect Kids From Internet

Schools and libraries urged the FCC to drop a proposal to limit or sunset E-Rate, the $2 billion-a-year program that connects students and library visitors to the internet. Chairman Brendan Carr led a 2-1 vote in June on a rulemaking notice asking whether the program should be curtailed, and groups such as the National Association of Elementary School Principals told the FCC it should reject any plan to eliminate or restrict it. Commenters also argue the FCC lacks the authority to terminate a program mandated by Congress. (from feed excerpt)

Eight US States Sue OpenAI, Claiming ChatGPT Harms Young Users

Attorneys general in eight states, including Kansas, Arizona, Iowa and Montana, filed separate state-court suits alleging ChatGPT is designed to be agreeable, reinforces delusions and encourages self-harm and violence. They allege consumer-protection violations and public nuisance, and seek design changes, civil penalties, damages and forfeiture of profits from young users. Reuters called it the most significant coordinated state action against an AI company; Florida filed the first such suit in June. (from feed excerpt)

Microsoft Defender Now Supports Linux Desktops

Microsoft Defender now officially supports Linux desktops in public preview, extending beyond servers to workstations running distributions such as Ubuntu, Debian, Fedora and RHEL. It offers antivirus, endpoint detection and response, vulnerability management, threat hunting and device isolation, and requires Defender for Endpoint Plan 2 or a Microsoft 365 E5 or E7 subscription. (from feed excerpt)

Epic Games' New Vibe-Coded Launcher Is 46% Faster Than Steam

Epic launched a preview of an AI-generated Games Launcher that a commissioned third-party benchmark found cold-starts in 5.47 seconds versus 10.07 seconds for Steam on Windows. Restoring from the tray is nearly even at 0.36 versus 0.42 seconds. The launcher adds library aggregation and new views, and Epic says Fortnite will come to Linux through it once Easy Anti-Cheat is rebuilt and kernel-level security agreements are in place. (from feed excerpt)

US Tech Giants Warn Europe That Data Sovereignty Requirements Could Cost $128 Billion

A study commissioned by CCIA Europe, whose members include Amazon, Google and Meta, estimates the EU's proposed Cloud and AI Development Act could cost 115 billion euros ($128 billion) over a decade, more than six times the European Commission's upper estimate. About 80 billion euros of that comes from a modeled scenario extending sovereignty rules to 25% of cloud workloads in essential private-sector industries. CCIA urges limiting the rules to sensitive workloads and using risk-based technical safeguards instead of corporate-origin requirements. (from feed excerpt)

Google Is Silently Linking Your Phone Number Across All Signed-In Accounts

Android's phone-number verification is now on by default and associates the device's number with every Google account signed in on the phone, including secondary and work accounts. Users report unexpected confirmation emails, and Android Authority notes that turning the setting off only prevents future linking, so numbers already attached must be removed manually from each account. (from feed excerpt)

Anthropic Warns Small AI Models Could Self-Replicate Through IoT Devices

Anthropic warned that by next year small AI models may be able to autonomously self-replicate across low-cost IoT devices, enabling worms that are hard to shut down because they have no central control point. In experiments on off-brand Android TV boxes and similar hardware, quantized models split into shards were able to run inference across devices, though the company noted significant challenges remain. It expects any spread to be slow, with a doubling time of days. (from feed excerpt)

Google Play Now Lets Anyone Build Private, Vibe-Coded Apps That Run On Android

Google Play now supports private personal apps that users can build with tools like Google AI Studio and run on their own devices without publishing to the Play Store. The feature starts in the US for users 18 and older, and Google says sharing with trusted friends and a path to full publication will come later. (from feed excerpt)

Netflix Cuts About 6% of Jobs In Biggest Layoffs Since 2022

Netflix is laying off about 1,000 employees, roughly 6% of its workforce, mostly in product, tech, legal and HR. Co-CEOs Greg Peters and Ted Sarandos said the business is strong and the full-year forecast is on track, while Reuters notes rising pressure from YouTube, TikTok and other rivals. (from feed excerpt)

Dutch Tax Authorities Cancel Microsoft 365 Cloud Rollout, Turn Toward Open Source

The Netherlands' Tax and Customs Administration abandoned its planned Microsoft 365 public-cloud rollout after about 5,000 employees had migrated, replacing it with an on-premises, open-source-oriented approach. The government paused the plan in July after an advisory council recommended reversing it, and keeps existing Microsoft software for now. A Linux Foundation report says 94% of EU organizations consider digital sovereignty important. (from feed excerpt)

Digg

Digg links point to Digg's own story pages, which aggregate the original sources. Two other front-page headlines (a China–North Korea bridge opening and US CPI data) are omitted because their story links could not be retrieved.

Josh Hutcherson cast as Mister Miracle in DC Studios' animated series

Hollywood Handle, citing IGN, reports Josh Hutcherson has been cast as Mister Miracle in DC Studios' animated series. The story drew 49 sources and 2.1M combined views, and reactions were split, with some welcoming the casting and others objecting to writer Tom King's involvement.

Brewers beat Dodgers 6-2, take 3-0 lead in NLCS

Milwaukee beat the two-time defending champion Dodgers 6-2 in Game 3 for a 3-0 NLCS lead. Jake Bauers hit a go-ahead homer after an 11-pitch at-bat, Garrett Mitchell homered next, and Robert Gasser threw five scoreless innings. The Brewers are one win from their first World Series since 1982.

Figma announces Specs to help guide AI agents with design rules

TechCrunch reports Figma announced Specs, a Markdown-style editor on the Figma canvas where teams define product requirements and design rules for people and AI agents. It enters open beta on paid plans, and Figma is also putting code layers into public beta so users can ask an agent to turn designs into code.

Tinker adds Dimuon optimizer for LoRA fine-tuning

Tinker introduced Dimuon, a new optimizer for LoRA fine-tuning that it says often reaches lower loss in fewer steps than AdamW in its SFT tests. The company says it is still experimenting and invited users to try it and give feedback.

Jailer 2 draws early praise for cameos and climax, with hit predictions

Social posts from October 14–15 praise the Tamil film Jailer 2's cameos and climax, with several predicting a hit. Some reviewers found the start slow, the villain weaker than in the first film, or the second half repetitive.

Bauers and Mitchell hit back-to-back homers as Brewers went up 4-2 in Game 3

In the seventh inning of NLCS Game 3, Jake Bauers ended an 11-pitch at-bat with a go-ahead homer and Garrett Mitchell followed with another off Blake Snell, putting Milwaukee up 4-2. Fan reaction was divided, with some praising Bauers and others blaming Dodgers manager Dave Roberts' pitching changes.

Xbox introduces Nano Controller for $49.99

Microsoft announced the Xbox Nano Controller, its smallest yet at a little over five inches long and 3.5 ounces. It has all 18 standard gameplay inputs, a rechargeable battery, a programmable Action Button and Xbox Wireless and Bluetooth support. Preorders opened October 14 and availability begins in November.

TSMC posts Q3 2026 earnings with 69% profit surge and revenue above guidance

TSMC reported third-quarter revenue of NT$1.494 trillion (about $46.7 billion), above its $45.8 billion guidance ceiling, with net income of NT$763.06 billion (about $23.6 billion). A summary post cites a 69% net profit rise and a 58.7% operating margin, driven by demand for advanced chips.

Jailer 2 advance bookings reportedly reached ₹41.05 crore gross, including block seats, by October 13

Sacnilk reported ₹41.05 crore in advance-booking gross for Jailer 2 across four show dates including block seats (₹35.77 crore without them), with Tamil bookings making up ₹35.74 crore, or 87%. One analyst argued wider Hindi-market distribution could lift totals.

AISLE and Cohere sign letter of intent to join forces

AISLE founder Stanislav Fort says AISLE and Cohere signed a letter of intent to join forces. He says AISLE found more than 500 real-world CVEs in its first year and, if the deal closes, he will lead AI security research at Cohere. Cohere CEO Aidan Gomez welcomed the AISLE team.

Jackson Chourio homers off Blake Snell on Game 3's first pitch

Jackson Chourio hit a leadoff home run on the first pitch of NLCS Game 3, off Dodgers starter Blake Snell, putting the Brewers ahead 1-0.

Neutron's first flight moves to 2027

Rocket Lab said on October 14 that the first Neutron launch is now expected in 2027 after a manufacturing defect was found in the forward dome of the first propellant tank. CEO Peter Beck outlined a three-step plan, with the first two steps done before Q1 2027 and the third during that quarter, after which a new target will be shared.

Apple TV renews 'Maximum Pleasure Guaranteed' for Season 2

Apple TV renewed the dark comedy thriller starring Tatiana Maslany and Jake Johnson for a second season. A writers room is underway, production is slated for the first half of 2027, and no premiere date was given.

Real Madrid come back from 3-1 down to beat Roma 4-3

Roma led 3-1 after two Donyell Malen goals in seven minutes, but Real Madrid scored through Carlos Espí (83rd minute), Endrick (85th) and a 90th-minute winner from Antonio Rüdiger to win 4-3 in the Champions League.

Fire Emblem Fortune's Weave Expansion Pass DLC has three waves

Nintendo announced a three-wave Expansion Pass for Fire Emblem Fortune's Weave that adds stories and lets players recruit gods. Wave 1 is available now, Wave 2 is planned for holiday 2026 and Wave 3 for 2027.

Zero-click spyware reportedly targeted 45 Al Jazeera devices through ads

WIRED reports Citizen Lab concluded that 45 Al Jazeera devices were targeted in 2024 and 2025 by zero-click attacks delivered through ads. Researchers say the ads were issued by Discover-Tech and attribute the spyware to Candiru. Google says it blocked Discover-Tech from its ad platforms, and IAB Europe suspended the firm from its vendor list.

Handwired turns JavaScript code into a neural net without training

The creator describes Handwired as a toy project that converts JavaScript if-else branches and loops into neural-net weights without training. Demos include a miniature OS running on compiled neural-net numbers in a browser and a WebGPU search over 100,000 JSONs.

Street Fighter Live-Action Movie Set for Oct. 16 Theatrical Release with $25-35M Domestic Opening Projection

DiscussingFilm reports the live-action Street Fighter film opens October 16 with a projected $25–35 million domestic opening and a roughly $70 million global start. Roman Reigns, who plays Akuma, described capturing the character's movements as a physical challenge.

BleepingComputer

Microsoft fixes bug causing Windows black screens, Explorer crashes

Microsoft resolved a known issue that caused black screens after sign-in, desktop loading problems and Explorer crashes following Windows 11 updates released since August. It mainly affected Azure Virtual Desktop hosts using FSLogix. The fix shipped in the October 13, 2026 Patch Tuesday updates, and Microsoft also offered a workaround of launching explorer.exe manually and a Known Issue Rollback for enterprises.

UK Legal Aid Agency: Hackers stole records dating back to 1978

The UK's Legal Aid Agency says attackers who breached its systems in April 2025 stole records going back to 1978. Most stolen data covers January 2007 to May 2025, but about 250,000 records predate 2007, nearly all from the 1990s and 2000s. The data includes applicant details such as national ID numbers and criminal history, as well as provider contracts and portal credentials.

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks patched CVE-2026-0322, a PAN-OS management-interface flaw (score 8.6) that lets authenticated attackers with network access run code as root, and says it has seen very limited exploitation. It affects PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixes cover several PAN-OS branches, with 11.2.16 expected October 15, and the company advises restricting management-interface access to trusted internal IPs.

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

In an operation codenamed "Lonestar Roundup," the FBI searched 40 Texas residences between September 21 and 25, seizing about 187 laptops and KVM devices used in North Korean remote IT-worker schemes. The DoJ arrested two suspects and charged 14 people tied to the Famous Chollima group. CrowdStrike, which tracked the group, says such actions will likely have limited impact on their own but may signal a broader enforcement push.

Ledger asks sellers across Asia to halt sales after supply-chain attack

Ledger asked resellers in Southeast Asia and Hong Kong to pull its wallets after finding hardware implants in devices sold by reseller CryptoBilis. The implant decodes the 24-word recovery phrase and sends it over LTE using an eSIM, without touching the Secure Element, so Ledger's integrity checks cannot detect it. All confirmed fund losses involve CryptoBilis devices, but users also report tampered units bought in Singapore and via MediaMarkt in Europe, which has pulled the product.

Cisco patches new Secure Email Gateway zero-day exploited in attacks

Cisco patched CVE-2026-76519, a path-traversal flaw in Secure Email Gateway's Advanced Malware Protection that lets unauthenticated attackers write files and run commands as root via a crafted email attachment. Cisco says it became aware of active exploitation in October 2026. Affected systems have File Reputation enabled and Content Scanner Tools older than 25.3.0.5525, and Cisco published indicators of compromise.

Microsoft fixes VPN issues caused by September Windows updates

Microsoft fixed a bug that left Always On VPN connections stuck connecting after the September 2026 Windows 11 updates when automatic protocol selection (IKEv2 with SSTP fallback) was used. The fix is in the KB5127648 and KB5127646 October updates, and the workaround is to configure the VPN profile for a single protocol.

The Blind Spots of Agentic Pentesting and How to Close Them

A sponsored article from Picus Security arguing that AI-powered penetration testing can uncover complex attack paths but leaves assets untested because of safety restrictions and network limits. It proposes pairing agentic pentesting with exposure validation and breach simulation. (from feed excerpt)

Global takedown hits network behind 1 billion phishing messages

Law enforcement and partners disrupted a Chinese-language cybercrime ecosystem tied to more than a billion malicious messages aimed at over 75,000 organizations in 150 countries. Microsoft and Japan's National Police Agency traced it to the YAM Store marketplace (Storm-3119), which sold compromised cloud accounts, and to the CoGUI, Haozi and Iron Man System phishing kits. More than 750 million messages hit Microsoft customers this year.

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

CISA urged immediate patching of CVE-2026-104935, an Ivanti Connect Secure authentication bypass allowing unauthenticated command execution, exploited since at least October 1. Volexity says actor UTA0576 chained it with two other flaws for root access and targeted Active Directory secrets, LAPS passwords and BitLocker recovery keys. Ivanti released fixed versions including 22.8R2.5 and 25.1.3.0, and Shadowserver tracks over 5,600 exposed hosts.

Hirudo Android malware replaces banking apps to evade security checks

ThreatFabric reports Hirudo, Android malware that uninstalls a victim's real banking app and installs a patched copy using a hooking engine to bypass signature, Accessibility and Play Integrity checks. It has impersonated at least seven Indonesian banks and targets institutions in China, India, Mexico, Morocco and Thailand. It spreads through loader apps posing as shopping or short-drama apps, and can steal credentials, capture screens and record audio.