Tech Industry
Japan steps up cyber warnings after 20+ company breaches
Japan told companies and banks to tighten security on October 9, 2026 after 20+ firms reported attacks. Times Car alone leaked about 6.6 million accounts.
Security news and analysis
Security incidents that hit developer infrastructure: supply-chain attacks on package registries, broken credential schemes, agent breaches. Each story says what was compromised, for how long, and what to rotate.
Tech Industry
Cyberattack warms fridges at hundreds of French stores
A cyberattack on October 11-12, 2026 changed Danfoss controller settings and warmed fridges in hundreds of French supermarkets. Stores threw food away.
Dev Stack
Zod 4.6.6 malware alarm: the bad commit never reached npm
Zod 4.6.6 shipped October 11 with malicious September 21 commits in its history. They were reverted that day, and none of them reached npm.
AI & LLMs
Microsoft Execution Containers for AI agents reach GA
Microsoft Execution Containers, generally available since October 7, wall AI agents off from files and networks on Windows 11, macOS and Linux.
Dev Stack
OpenSSH 10.6 adds post-quantum signatures, speeds releases
OpenSSH 10.6, out October 6, adds a post-quantum signature type, turns off LZ77 compression and promises faster fixes as AI bug reports pour in.
Tech Industry
Yandex shuts Vladimir data center after drone attack
Yandex says an October 11 drone attack shut its Vladimir data center, the third Yandex site hit in four days. Over 80 cloud services were reportedly down.
AI & LLMs
Anthropic says Claude sent police a false tip in a test
Anthropic's October 9 report says Claude agents sent Philadelphia police a false tip and used government sites in tests. Live web is now off in evals.
Tech Industry
Bitwarden switches store apps to a commercial license
From its next release, Bitwarden's app store builds and website downloads will be commercially licensed. The GPLv3 source code stays public on GitHub.
Tech Industry
Telegram Desktop bug let one click steal session files
A researcher published a proof of concept for CVE-2026-107181: one click in Telegram Desktop 7.2.8 or older could steal session files. Update to 7.2.9.
Startup Watch
Rein Security raises $25M to guard enterprise AI agents
Rein Security raised $25M, co-led by Glilot and Sienna, for software that watches and limits what enterprise AI agents do. Revenue is up 8x since January.
Startup Watch
Xona Pulsar satellites set to launch a GPS alternative
Xona will launch six Pulsar satellites on a SpaceX rocket this month. The startup says its GPS alternative reaches centimeter accuracy and resists jamming.
AI & LLMs
Anthropic Cyber Mission: free scans for open-source code
Anthropic's Cyber Mission, launched October 8, gives open-source projects free Claude vulnerability scans and gives 11 security firms models and engineers.
Dev Stack
VS Code 1.141 sandboxes AI agents on Windows, macOS, Linux
VS Code 1.141 sandboxes AI agents on Windows, macOS and Linux, shows agent sessions in a grid and picks up Codex and Copilot chats started in other apps.
Tech Industry
Asos confirms breach after hackers hijack app alerts
Asos confirmed a breach at a third-party platform after an "ASOS HACKED" push alert reached shoppers on October 6. Names and contact details may be exposed.
Dev Stack
MALFEX npm malware ran undetected for 14 months
MALFEX, a one-person npm malware campaign, published 12 packages since 2023 and drew 40,767 downloads. Some packages are still live with no advisory.
Startup Watch
Hadrian raises $40M for AI agents that test your defenses
Hadrian raised $40 million, bringing its total to $65 million, for AI agents that map attack surfaces and run penetration tests for firms like McKesson.
AI & LLMs
Google pauses its open-source bug bounty over AI reports
Google stopped taking OSS VRP bug reports on October 1 after a surge of AI-generated submissions, most of them invalid. An update is due in Q1 2027.
Tech Industry
Denmark CPR breach exposes 8.8 million personal records
Attackers misused a Danish company's legal access to the CPR register and pulled names, addresses and ID numbers of 8.8 million people in September.
Tech Industry
Microsoft Titan flaw exposed 17.3 trillion rows to a teen
Titan accepted unsigned login tokens, so a 16-year-old could query 17 databases holding 17.3 trillion rows. Microsoft fixed it and paid him $5,000.
Coding
Rejetto HFS CVE-2026-61500 exploited a day after write-up
HFS 3.0.0 to 3.2.0 signs logins with Math.random(), a flaw Anthropic's Mythos found. Attacks began October 3, a day after the write-up. 3.2.1 fixes it.
Dev Stack
Git post-checkout hook malware targets developers
Developer Frank Wiles says a fake client sent him a repo whose git post-checkout hook fetched malware on a branch switch. Job seekers face the same trick.
Dev Stack
GitHub App installation tokens are now 520-character JWTs
GitHub finished moving App installation tokens to a stateless format on October 2. They now run about 520 characters, up from 40, and old checks may break.
Dev Stack
Apple tightens macOS Full Disk Access over AI agents
Apple said on October 2 that Mac apps will need "very explicit user action" to get Full Disk Access, because AI agents make that access riskier.
Dev Stack
Git 3.0's SHA-256 default is a costly mistake, says Chacon
Scott Chacon says Git 3.0's SHA-256 default fixes a problem no repository has hit and breaks 40-character hashes everywhere. Git says no date is set.
The weekly digest
One email every Friday with the week's top stories from all six desks: AI, dev tools, coding, the tech industry, startups and what's next. Free, no spam.