2026-10-27 17:00 UTC | BLOCK 973423 BITCOIN $80,572 | GOLD $4,059 | OIL $109.52 1. French Court Blocking Orders Drive Privacy Resolver Quad9 Out of France -- Quad9, the Swiss non-profit DNS resolver, will stop serving users in France on 24 November after a French court ordered it to block sites accused of infringing a sports broadcaster's copyrights, with roughly 20 similar suits pending. -- The order forced a choice between applying French law worldwide or isolating French users for blocking it cannot verify reliably, where imperfect enforcement brings fines. French users fall back on ISP resolvers that face heavier censorship and police demands, and the EFF calls the case a warning for site-blocking bills before the US Congress. 2. Honda Warns 50% Canada Auto Tariffs Would Be Catastrophic -- Honda said doubling US tariffs on Canadian vehicles and parts from 25% to 50% would be catastrophic for the industry, after President Trump tied the increase to reaching a trade deal with Ottawa. -- A 50% duty compounds along cross-border supply chains, where parts can cross several times before final assembly, rather than applying once at the border. The unresolved question of a deal also leaves automakers unable to fix production and pricing assumptions. 3. Warp Breach Exposes AI Agent Logs and Developer Telemetry -- Warp said a breach at a third-party vendor in its infrastructure exposed agent decision logs and telemetry data, hitting an estimated 1% of users of its agentic development environment, a product with at least 800,000 users. -- Agent traces sit higher up the stack than ordinary logs and may carry prompts, source code or credentials, so the real exposure is unknown until Warp says what the records held. The intrusion follows an OpenCode breach that leaked API keys and produced unauthorised charges of up to $1,700 for some users. 4. Oracle Widens Nvidia Chip Deal and Adds Google and Cerebras Supply -- Oracle expanded its chip-supply agreement with Nvidia and added Google and Cerebras offerings to its cloud lineup, broadening the vendors behind its AI infrastructure. -- Splitting supply across three vendors hedges allocation risk as Oracle Cloud competes with AWS and Microsoft, and it hands customers an alternative to Nvidia GPUs. The deal also leans the company's outlook further on AI capital spending that investors have begun to question.

2026-10-27 16:00 UTC | BLOCK 973418 BITCOIN $80,480 | GOLD $4,059 | OIL $109.31 1. Norway and Finland Leaders Hold Rare Call With Putin on Ukraine -- Norwegian Prime Minister Jonas Gahr Støre said he and Finland's Alexander Stubb held a "substantive" call with Vladimir Putin, the first direct contact between European leaders and the Russian president in more than a year, as Russia and Ukraine prepare for US-brokered peace talks. -- Støre said the two spoke only for their own countries, so the call leaves Europe without a joint position while Washington mediates; both states border Russia, making the terms of any freeze, from sanctions relief to security guarantees, a direct national concern. 2. Iran Threatens South Korean Shipper Sinokor Over Hormuz Transits -- Iran accused South Korea's Sinokor of repeated "crossing violations" in the Strait of Hormuz, the Financial Times reported, warning a carrier that sails through a waterway Tehran has so far policed only with military action. -- Iran has enforced its rules by seizing and firing on ships rather than through courts, so a warning aimed at a named operator raises the risk of a boarding or detention; that would lift war-risk premiums for shipping on a route central to Gulf crude exports, with Brent at $109.31. 3. FTC Signals Suit to Block Cintas' $5 Billion Unifirst Takeover -- FTC staff have told Cintas they will move to block its $5 billion purchase of rival Unifirst over the combined company's market share, Semafor reported; no commission vote or formal last-rites meeting has been held, and Unifirst shares fell 12% while Cintas dropped 6%. -- It cuts against dealmakers' assumption that this administration waves mergers through, even after Paramount's $110 billion Warner Bros. Discovery purchase cleared, and would force the largest uniform-rental suppliers into a court fight over market share. 4. Boeing Pushes 737 Max Ramp to Late 2027 as Wing Supply Lags -- Boeing said it will not significantly increase 737 Max production until late 2027 because wing production is falling behind, and will brief investors on its aircraft outlook alongside quarterly results. -- Holding the narrowbody rate flat for another two years limits how quickly airlines can add capacity and keeps wing suppliers, not final assembly, as the binding constraint on the delivery revenue Boeing needs to steady its finances. 5. Galaxy Shares Jump as Helios Posts $69 Million in First CoreWeave Rent Quarter -- Galaxy Digital shares opened about 6% higher after its Helios data center unit reported $69 million in adjusted EBITDA in the first full quarter it collected rent from CoreWeave, Blockspace Media reported. -- The quarter shows a bitcoin miner converting power contracts and sites into AI tenancy, but it also ties a mining balance sheet to CoreWeave's funding, so market doubts about AI capital spending now reach mining equities, with BTC at $80,480.

2026-10-27 15:00 UTC | BLOCK 973408 BITCOIN $80,280 | GOLD $4,045 | OIL $109.61 1. Ripple Taps Robinhood to Widen RLUSD Stablecoin -- Ripple struck a deal with Robinhood to expand distribution of its RLUSD dollar token, CNBC reported, as stablecoins shift from trading collateral toward market infrastructure. -- Brokerage distribution puts the token in front of retail accounts and squares it against Tether and Circle for the float and redemption volume that decide stablecoin economics; stalled U.S. market-structure legislation leaves the legal terms unfinished. 2. Tailscale Warns of 11 Flaws Allowing SSH Privilege Escalation -- Tailscale called "serious" 11 vulnerabilities that Cyberdione Labs found in its WireGuard mesh VPN and the self-hosted headscale server, with patches promised by the end of Tuesday; the most severe can give an authorized connection root code execution through Unix-socket forwarding. -- A device trusted on a tailnet could act beyond its configured user rights, and the vendor is still verifying which configurations are exposed, so operators should plan client updates rather than disable SSH.

CODE WIRE | BLOCK 973410 BITCOIN $80,212 | GOLD $4,049 lightning-browser-extension v3.15.1 -- Alby’s browser extension integrates Lightning and Nostr with the web, providing a wallet interface to multiple Lightning nodes and key signing for Nostr, Liquid and onchain use. -- Keysend now accepts only positive whole-satoshi amounts as numbers or digit-only strings, rejecting invalid inputs before prompting. The same validation applies to keysend payments started within the extension. -- GitHub:

GitHub

Release v3.15.1 🏹🌌 The Great Nebula in Orion · getAlby/lightning-browser-extension

TL;DR A small patch release on top of 3.15.0. We recommend all users update. Keysend amounts — webln.keysend() now only accepts the amount as a ...

EDITOR WIRE | 2026-10-27 | BLOCK 973410 BITCOIN $80,312 | GOLD $4,048 | OIL $109.47 | S&P 500 $7,696 | US 10Y 5.02% Apple patches iPhone security flaws, including bug linked to targeted attacks Apple released iOS 27.2 and iOS 18.7.11 on October 26, addressing vulnerabilities affecting web-content processing, system memory and camera permissions. The older-device update also fixes a separate CoreGraphics flaw that Apple says may have been exploited in an “extremely sophisticated attack against specific targeted individuals” running versions before iOS 27. That warning concerns CVE-2026-86950—not every vulnerability in the releases. The iOS 27.2 fixes include CVE-2026-112697, a WebKit use-after-free flaw that could allow arbitrary code execution when a device processes maliciously crafted web content. A hostile page reaching the vulnerable code path could therefore execute attacker-controlled code; Apple’s advisory does not establish that this flaw alone provides complete control of an iPhone. A separate kernel flaw, CVE-2026-112507, could let an app crash the system or write to kernel memory. Apple fixed it with improved bounds checking. CVE-2026-86990, affecting CoreMedia, could let a malicious app access the camera without user permission. These app-based risks are distinct from the WebKit attack path; the camera advisory does not say a website alone could activate the camera or that the camera-use indicator could be suppressed. The two updates do not contain identical fix lists. Apple’s iOS 18.7.11 advisory lists the shared camera flaw, an audio-related information leak, and the CoreGraphics vulnerability associated with the targeted-attack report. The CoreGraphics issue can permit arbitrary code execution when a maliciously crafted file is processed. Apple’s wording does not establish widespread exploitation or a confirmed zero-click attack. Install the latest compatible update offered under Settings → General → Software Update. Apple lists iOS 27.2 for iPhone 11 and later, and iOS 18.7.11 for iPhone XS, XS Max and XR. It also released iOS 26.7.2 for supported devices remaining on that branch. The practical response is prompt patching—not assuming that avoiding suspicious links alone addresses flaws involving apps and file processing. Sources:

Apple Support

About the security content of iOS 27.2 and iPadOS 27.2 - Apple Support

This document describes the security content of iOS 27.2 and iPadOS 27.2.

Apple Support

About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support

This document describes the security content of iOS 18.7.11 and iPadOS 18.7.11.

Apple Support

Apple security releases - Apple Support

This document lists security updates for Apple software.

2026-10-27 13:00 UTC | BLOCK 973396 BITCOIN $80,230 | GOLD $4,023 | OIL $109.89 1. Oleshky Ceasefire to Run Until November 1, Kyiv Lawmaker Says -- The truce around Russian-occupied Oleshky began at 03:00 Kyiv time and will remain in effect until 22:59 on November 1, said David Arakhamia, head of Ukraine's Servant of the People parliamentary faction, who called it the largest de-escalation since 2022; the arrangement is part of a US First Lady Melania Trump initiative to unblock aid to the town. -- A fixed expiry gives aid convoys and remaining residents a defined window rather than an open-ended pause, but no monitor has been named, leaving civilian security and relief logistics dependent on both armies' restraint; Russian missiles struck Kyiv hours after the truce began. 2. Jordan Acknowledges Civilian Deaths in Syria Airstrikes -- Jordanian Communications Minister Mohammed al-Momani said Tuesday that civilians died in Monday night's strikes on Islamic State targets in southern Syria, after Syrian authorities said the attacks in Daraa and Sweida killed seven people; Jordan says its aircraft killed more than 20 militants. -- Bombing across the border converts a domestic security failure into a campaign Damascus says was uncoordinated, despite Jordan's account of prior coordination. Syria has closed its crossings, placing the land routes that carry Jordanian trade with Turkey and Europe inside the quarrel. 3. Russian Diesel Tankers Set Course for the US Under Trump-Putin Deal -- Moscow said three tankers carrying Russian diesel are bound for the United States, with a fourth due to depart Wednesday, under the arrangement Trump struck with Vladimir Putin easing sanctions in return for fuel supply; the Financial Times reports two of the vessels are themselves under sanctions. -- Cargo tied to sanctioned ships exposes US refiners, traders and their lenders to congressional scrutiny, and Senate Democrats have already told banks and ports to preserve records. The barrels land with Brent near $110, a test of whether the deal actually cheapens US fuel. 4. Keystone to Destroy 18,835 Wallets After Verification Key Theft -- Keystone said an attacker who breached its website obtained the key its hardware wallets use to prove they are genuine, and the company will destroy 18,835 units rather than sell them; anyone holding the key could build a counterfeit able to pass the authenticity check owners run on a Keystone. -- That check is a buyer's last defence before entering a seed phrase, so a forged device that looks genuine can drain the wallet it initialises. Withdrawing affected stock, rather than pushing a software warning, is Keystone's answer. 5. Microsoft Patches Authenticator Flaw That Let Blank Android Apps Steal Work Tokens -- Microsoft fixed CVE-2026-80097 in Authenticator for Android version 6.2606.4246, closing a hole that let an app with no permissions launch the app's account-chooser and claim to be Teams, receiving sign-in tokens that opened the victim's work mail, files and calendar. -- Authenticator brokers logins for Outlook, Teams and other Microsoft apps on one device, so the failure is an identity-security problem rather than an app bug: one misidentified caller reached an entire account. Microsoft says the bug went unexploited, but the vendor and researchers disagree on whether a victim had to finish a sign-in step, so fleet policies pinning minimum app versions are the reliable fix.

CODE WIRE | BLOCK 973396 BITCOIN $80,182 | GOLD $4,023 ngit-cli v3.0.4 -- ngit is a command-line tool for a Nostr-based GitHub alternative for free and open-source repositories. -- v3.0.4 rejects compromised eMudhra/emSign intermediate certificates and removes the affected root from bundled certificate stores, addressing TLS endpoint impersonation risks affecting relay connections and Android HTTPS. -- GitHub:

GitHub

Release v3.0.4 · DanConwayDev/ngit-cli

Update certificate trust and dependencies, improve interactive workflows and diagnostics, and clarify handling of conflicting installations. Securi...

CODE WIRE | BLOCK 973391 BITCOIN $79,894 | GOLD $4,016 openclaw v2026.10.8 -- OpenClaw is an AI tool designed to perform tasks across operating systems and platforms. -- The release blocks sandboxed child processes from running host CLI backends, requires approval for test -v operand expansion in exec allowlist mode, and prevents Fish Audio and Gradium errors from exposing API keys. -- GitHub:

GitHub

Release openclaw 2026.10.8 · openclaw/openclaw

2026.10.8 Highlights Updates that finish and recover: an ordinary post-update Doctor failure restarts the Gateway instead of leaving it stopped, a...

2026-10-24 07:00 UTC | BLOCK 972892 BITCOIN $80,774 | GOLD $3,998 | OIL $111.75 1. Trump Floats 200% Tariffs on Russia and Ukraine -- President Donald Trump said the United States could impose 200% tariffs on Russia and Ukraine to force an end to the war, Ukrinform reported. -- U.S. importers sourcing from either country would face sharply higher duties if the proposal became policy; the remarks alone do not change customs obligations. 2. Russia Uses 61 Jet-Powered Shaheds in Overnight Drone Attack -- Ukraine's military said Russia launched 126 drones overnight, including 61 jet-powered Shaheds, and reported hits at 14 locations despite shooting down or suppressing 101 drones. -- Jet-powered attack drones can shorten interception windows, making early detection and rapid engagement more important for protecting civilian infrastructure.

WEEKLY WIRE | 2026-10-23 | BLOCK 972830 BITCOIN $81,494 | GOLD $4,000 | OIL $111.42 | S&P 500 $7,634 | US 10Y 5.03% NEWS 1. Middle East tensions push energy costs higher -- Crude reached $117 on Friday for the first time since April amid fears of renewed Iran hostilities, the Financial Times reported; CNBC also reported Brent at a six-month high. -- Higher energy prices are lifting U.S. inflation expectations and increasing fuel-cost exposure for transport companies and energy importers. 2. Ukraine seeks satellite alternatives as Starlink restrictions persist -- Ukraine reported continued Starlink and Starshield restrictions Friday despite Trump's assurances, while CNBC reported that Kyiv was partnering with Nokia and ICEYE in its search for alternatives. -- Diversifying providers could reduce dependence on SpaceX for military connectivity, but the partnership announcement does not establish that replacement capacity is ready for battlefield use. 3. Russia and Ukraine agree humanitarian truce around Oleshky -- Russia and Ukraine confirmed a temporary ceasefire around Russian-occupied Oleshky to permit humanitarian aid and civilian evacuations, the BBC and Financial Times reported Friday. -- For civilian security, safe evacuation could reduce residents' exposure to fighting; the local agreement does not establish a wider ceasefire. 4. Justice Department seeks conditional block on Alaska Senate certification -- Trump said Friday he ordered the lawsuit seeking to pause certification if incumbent Dan Sullivan loses, pending an investigation into alleged voter confusion with another Republican named Dan Sullivan, the Guardian reported. -- A court-ordered delay could postpone certification of the winner in a race that may determine Senate control; filing the complaint does not itself block certification. 5. AI share selloff sends investors toward Treasuries -- CNBC reported Meta shares down 9% for the week Friday and the 10-year Treasury yield trading just below 5% during the session as AI-related technology selling drove investors toward government bonds. -- Capital-intensive AI businesses face a harder equity-funding environment even when demand for government bonds lowers benchmark interest rates. 6. U.S. revises Canadian tariffs as exemptions are announced -- Trump signed a proclamation Friday modifying Canadian product tariffs under Section 338 of the Tariff Act of 1930; Senator Susan Collins said several import categories would receive exemptions, CNBC reported. -- Exemptions would lower costs for covered imports without ending the broader tariff regime, making product eligibility decisive for businesses sourcing from Canada. 7. AI-assisted research exposes critical PHP flaws -- Researchers used AI to identify critical flaws this week in PHP, a programming language used across millions of websites, the Guardian reported. -- Shared runtime flaws can expose otherwise unrelated websites, requiring operators to assess their underlying PHP deployments rather than rely only on application-level defenses. 8. BlackX bootkit targets Central Asian diplomatic organizations -- Kaspersky documented a UEFI bootkit used against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan earlier in 2026 and suspects China-linked APT41 involvement, The Hacker News reported Friday. -- Secure Boot can be bypassed on patched Windows systems missing the relevant revocations, so operating-system update status alone does not establish protection. SOFTWARE 9. Eclair 0.14.5 -- Bitcoin Optech's October 23 newsletter details fixes for trampoline-routing and Taproot-splicing vulnerabilities, plus an integer-overflow bypass in onion-payload validation, in this Lightning node security release. -- For Lightning payment security, the routing fix closes a flaw that could let a malicious payer steal funds from a forwarding node; the project strongly recommends upgrading.

CODE WIRE | BLOCK 972656 BITCOIN $81,368 | GOLD $4,027 LocalAI v4.12.0 -- LocalAI is an open-source engine for running AI models on hardware that does not require a GPU. -- Version 4.12.0 redesigns the web UI and adds streaming voice responses, native decision routing, image upscaling, Qdrant stores and authenticated chat history. -- GitHub:

GitHub

Release v4.12.0 · mudler/LocalAI

🎉 LocalAI 4.12.0 Release! 🚀 LocalAI 4.12.0 is out! This release redesigns the web UI and adds streaming voice responses, native...

EDITOR WIRE | 2026-10-21 | BLOCK 972527 BITCOIN $84,696 | GOLD $4,138 | OIL $105.53 | S&P 500 $7,759 | US 10Y 5.13% GitLab patches critical unauthenticated code-execution flaw across older releases GitLab has issued an urgent patch for CVE-2026-110264, a CVSS 10.0 flaw in the regular-expression compiler shipped with its Community and Enterprise editions. GitLab says that, under certain conditions, compiling a specially crafted expression could let an unauthenticated attacker run code on a self-managed server. Affected releases extend back to GitLab 7.0. GitLab has not disclosed the conditions needed to reach the vulnerable path, so the rating should not be read as proof that every exposed instance can be compromised with a single request. The practical risk is control of the server running GitLab. If an attacker can get a crafted expression compiled through the vulnerable path and achieve code execution, they could attempt to access repositories, credentials or other data available to that server. Those are potential consequences of server-side code execution, not reported outcomes of an observed attack. GitLab has published detections for Onigmo native-worker crashes and bursts of Org-mode rendering errors to help self-managed operators investigate possible attempts. GitLab also fixed separate authentication issues in this release. One could let a logged-in user take over an LDAP-backed account only where both OmniAuth SAML and LDAP auto-linking are enabled. Another could let an unauthenticated attacker poison a shared OAuth/OIDC discovery cache and redirect certain sign-in flows to an attacker-controlled server under affected conditions. Neither has the same prerequisites as the regex-compiler flaw. Self-managed operators should upgrade promptly to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, according to their release line. GitLab says GitLab.com is patched and specified GitLab Dedicated internal releases already contain the fixes. The 19.4.3 and 19.3.6 upgrades include database migrations; single-node administrators should plan for downtime while they complete. Sources:

GitLab Docs

GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab Docs

The Hacker News

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.

2026-10-19 18:00 UTC | BLOCK 972185 BITCOIN $81,900 | GOLD $4,146 | OIL $106.72 1. OpenCode Breach Exposes Provider Keys; Users Report Charges -- OpenCode said external-provider keys held by 1.4% of Console users were exposed in a breach; affected users reported unauthorized API charges of up to $1,700, BleepingComputer reported. -- Valid keys can generate charges and trigger cloud-project suspensions, so affected teams need to rotate them and audit provider usage as well as secure their OpenCode accounts.

2026-10-18 21:00 UTC | BLOCK 972053 BITCOIN $80,796 | GOLD $4,148 | OIL $107.18 1. Macron Pledges Transparency as French Protest Arrests Top 2,300 -- French police arrested more than 2,300 people over the weekend amid violent protests over living costs and school conditions; President Emmanuel Macron promised transparency over the security response, France 24 reported. -- Scrutiny of police preparations and use of force could affect how authorities handle further demonstrations, but Macron announced no change in policing policy.

2026-10-18 10:00 UTC | BLOCK 971969 BITCOIN $82,240 | GOLD $4,156 | OIL $106.67 1. Yemen Displacement Passes 233,000 as Taiz Hospitals Run Short of Fuel -- More than 233,000 people have been displaced since fighting escalated in Yemen, including about 121,000 in Taiz, while the WHO says the city's 12 hospitals have fuel for only four days, Al Jazeera reported. -- Fuel and surgical-supply shortages threaten hospitals' ability to treat casualties and respond to a growing cholera outbreak. 2. Forming Offshore Low Threatens U.S. East Coast With Flooding -- The National Hurricane Center expects a storm-force non-tropical low to form off the southeastern United States later Sunday or Sunday night, bringing high winds, coastal flooding and dangerous surf to parts of the East Coast. -- Coastal communities and vessel operators face hazardous conditions whether or not the system develops subtropical characteristics; the center puts that chance at 30% over seven days.

2026-10-18 07:00 UTC | BLOCK 971954 BITCOIN $81,720 | GOLD $4,158 | OIL $106.72 1. Guatemalan Former Prosecutor Killed; Two Suspects Arrested -- Former anticorruption prosecutor Juan Francisco Solorzano Foppa and another man were shot dead Saturday at a Guatemala City sports complex; police arrested two suspects, Al Jazeera reported. -- The killing heightens security concerns for anticorruption lawyers, though investigators have not established a motive or a link to Foppa’s past cases. 2. UK Plans Heating-Oil Rule Changes as Costs Surge -- The UK government plans tighter heating-oil market rules and a review of minimum order sizes after prices rose by up to 82% since the Iran war began, according to the BBC. -- Smaller minimum orders could help off-grid households buy fuel without paying for a full tank, but the announced measures do not provide immediate price relief.

2026-10-18 06:00 UTC | BLOCK 971952 BITCOIN $81,702 | GOLD $4,158 | OIL $106.81 1. Russian Shadow-Fleet Tankers Falsify Locations -- Tankers in Russia’s shadow fleet are using apparently coordinated location deception that makes them appear in two places at once, the Financial Times reported. -- False positions make oil shipments harder for maritime authorities and sanctions enforcers to track.

2026-10-17 11:00 UTC | BLOCK 971841 BITCOIN $81,612 | GOLD $4,165 | OIL $107.00 1. IMF Warns Poor Countries Spend Up to 14% of Revenue on Debt -- IMF chief Kristalina Georgieva said low-income countries now spend 8% to 14% of their revenue on debt repayments as higher borrowing costs and war-driven price shocks strain their finances. -- Debt service and higher fuel-import bills leave oil-importing governments less room to shield households from rising prices.

2026-10-16 16:00 UTC | BLOCK 971731 BITCOIN $81,654 | GOLD $4,179 | OIL $103.47 1. Mexico Issues Hurricane Warning as Trudy Approaches Coast -- Mexico issued a hurricane warning from Manzanillo to Playa Perula as Trudy carried sustained winds of 120 mph and approached the coast ahead of the weekend, the National Hurricane Center said. -- Ports and coastal operators in the warning zone have less time to secure vessels and equipment; the storm’s exact path remains uncertain.

2026-10-16 15:00 UTC | BLOCK 971722 BITCOIN $82,334 | GOLD $4,190 | OIL $103.11 1. U.S. Senators Seek Inquiry Into Ukraine’s Starlink Restrictions -- A bipartisan group of U.S. senators asked the Pentagon’s inspector general to investigate Starlink speed restrictions in Ukraine; President Volodymyr Zelensky said Friday that service had not been fully restored, the BBC reported. -- The inquiry could establish whether U.S. authorities or contractors imposed the limits, while incomplete restoration leaves Ukrainian drone operators unable to count on high-speed satellite links.