Google Cloud customers running VMs on AMD Turin processors need guest operating system patches and a full stop-start to address three CPU side-channel flaws. Google has protected against attacks between VMs and their hosts, but code running inside a VM could still infer data from other processes or the kernel.

Source

Nvidia CEO Jensen Huang has resigned immediately, and Chief Financial Officer Colette Kress will lead the chipmaker while its board searches for a permanent successor. The announcement follows reports that directors might consider removing Huang after shares fell. Nvidia did not give a reason for his departure.

Source

Police and Europol have recovered more than 6 million stolen credentials in a new Operation Endgame takedown targeting Gootloader, CastleRAT and StealC. The operation seized or blocked 235 servers and 257 domains, including 102 StealC servers, following a June disruption of StealC infrastructure by Microsoft and its partners.

Source

Microsoft plans an out-of-band Windows update within days to fix a SQL Server issue that can leave external database connections open and degrade performance. The problem emerged after the October 13 update, KB5126646. A mitigation is available through Microsoft business support in the meantime.

Source

Microsoft’s.NET platform supports application development across Windows, Linux and macOS. In the newly released .NET 11, security changes include authentication refresh for long-running SignalR connections and a configurable waiting period for newly published NuGet packages.

Source

Node.js, a runtime for server-side JavaScript, has released security updates for 16 vulnerabilities, including flaws that can crash HTTP/2 servers or expose data from other connections. The fixes are available in versions 22.23.5, 24.22.3, and 26.13.1; seven of the vulnerabilities are rated high severity.

Source

GSocket is a legitimate open-source remote-access tool that can connect Linux systems through a shared relay network. Microsoft has found attackers planting it on compromised servers to retain access even after the original vulnerabilities are patched. Devices with GSocket-related detections rose 356.2% between March and August 2026, according to Defender for Endpoint telemetry.

Source

Windows 11 update KB5132061 can cause previously signed PowerShell scripts to fail verification because it applies stricter text-encoding checks. The change affects scripts with malformed UTF-8 and comes after users reported installation failures with the same update. Microsoft recommends reviewing affected scripts, saving them as UTF-8 with a byte-order mark, and signing them again.

Source

Apache HTTP Server, the web server used to host websites and applications, has received a fix for a critical HTTP/2 vulnerability that could allow unauthenticated attackers to execute code remotely. CVE-2026-119618 affects versions 2.4.55 through 2.4.70 when HTTP/2 is enabled; Apache 2.4.71 fixes it.

Source

An attacker used 4,837 compromised GitHub accounts to probe tens of thousands of repositories and run a continuous integration (CI) secret stealer in at least 1,835 of them, according to security firm Aikido. The malware can steal workflow credentials and establish cloud access that survives token rotation. New probe requests continued after researchers’ initial search ended.

Source

Microsoft is removing trust in eMudhra root certificates after a compromise involving the certificate authority raised concerns about certificates used to establish trust. Microsoft plans to remove trust in 10 remaining eMudhra root certificates from Windows 11 and 10 on November 16 through automatic certificate updates, without requiring another cumulative update. The change follows Windows updates that removed seven certificates after the eMudhra certificate authority compromise. Edge and WebView2 will receive their trust changes separately.

Source

Nvidia directors may discuss removing CEO Jensen Huang amid reports of extramarital affairs and an investigation into his conduct, with shares falling about 8% after hours.

Source

Two suppliers have disclosed work on Apple AI glasses and new smart headphones, giving fresh weight to reports of camera-equipped wearables.

Source

Investors are lining up for Anthropic’s IPO, with indications of interest reportedly covering the shares on offer several times over.

Source

Palantir CEO Alex Karp sees hands-on tradespeople and neurodivergent thinkers as better positioned for an AI-shaped workplace, where routine junior coding, contract review, and copywriting may no longer be the career footholds they once were.

Source

Microsoft has disclosed two Windows BitLocker security bypass flaws that require physical access to an affected device. One can expose encrypted system-drive data to an attacker with basic user privileges; the other requires no existing privileges. Microsoft lists security updates for affected systems and rates both vulnerabilities Important.

Source

PowerShell 7.7, Microsoft’s automation shell for Windows, Linux, and macOS, is generally available with a.NET 11 foundation. The release adds commands and security protections, but administrators should check scripts and deployment methods before upgrading: Windows installations no longer have an MSI package.

Source

In Exchange Online, a message can move to an Online Archive after two years even when a personal tag sets deletion for five years. Messaging Records Management (MRM) treats archiving and deletion as separate actions, and assigning a policy does not immediately trigger either one.

Source

Mastercard is highlighting the need to protect AI agent data while it is being processed, not just when it is stored or transmitted. At KubeCon + CloudNativeCon NA, cloud engineering executive Krishna Mayuram pointed to confidential computing as a way to isolate sensitive workloads in secure environments.

Source