Pwn2Own Pays $1.26M for 98 Zero-Days as Apple Readies HomeView Hub

AI & Machine Learning

Stack Overflow’s latest developer survey, covering 30,903 developers and technologists in 169 countries, shows AI has become a daily fixture of software work but has not earned developers’ trust. Nearly a third of daily AI users spend four or more hours of their workday with it, and roughly 80 percent use it for at least an hour a day. Coding assistants and agents are used by 66 percent of respondents, chat tools by 63 percent and automated agent workflows by 26 percent, while 17 percent use no AI tools at all. Yet only about 7 percent trust AI output for important work decisions, 48 percent trust it only when they can easily verify it, and 79 percent say source attribution matters when judging an AI-generated answer. The gap between heavy usage and low trust suggests verification and provenance features, not raw capability, are now the battleground for AI developer tools. Source: The Register Verified: True

Consumer Hardware

Apple is expected to announce a new smart home hub called HomeView on Tuesday, October 13, according to Bloomberg reporting summarised by TechCrunch. The Siri-powered device has a display and an A18 chip, and will reportedly come in countertop and wall-mounted versions for controlling other smart home gear. Apple is also said to be preparing refreshed Apple TV and HomePod mini models, plus an LG partnership covering a smart lock, thermostat and doorbell. After years of limited traction for HomeKit and the HomePod, HomeView is shaping up as Apple’s most serious push into the smart home yet. Source: TechCrunch Verified: True

Raspberry Pi has shipped its first Raspberry Pi Desktop release for ordinary PCs in four years, jumping straight to Debian 13 “Trixie” and skipping Debian 12 entirely. The release brings the same Wayland-based desktop found in Pi OS 6 to x86-64 PCs and Intel Macs, but drops 32-bit support and does not run on Apple Silicon. Users of the old 32-bit edition cannot upgrade in place and need a fresh install. The update arrives after Debian 11 “Bullseye”, which the previous PC edition was built on, reached the end of Long Term Support on August 31. Source: The Register Verified: True

Apple has disclosed a reverse acqui-hire deal with Huxe, a personalised AI audio startup founded by former NotebookLM developers, in a regulatory filing to the European Commission. Under the agreement Apple makes job offers to certain Huxe employees and gains nonexclusive rights to the startup’s intellectual property. Huxe announced its shutdown on May 21, and Apple notified Brussels of the deal on June 9, though the filing does not say who joined or what Apple plans to build. The move hints at Apple’s interest in AI-generated, personalised podcast features as Spotify pushes into the same space. Source: TechCrunch Verified: True

Cybersecurity

Researchers earned $1,262,000 for 98 zero-day vulnerabilities at Pwn2Own Ireland 2026, the hacking contest run by Trend Micro’s Zero Day Initiative. Ikotas Labs took Master of Pwn with 42.5 points and $361,000, including a $300,000 top prize for chaining zero-days to compromise the Google Pixel 10. Xint finished second with $240,000 and Team ZyGoat third with $125,000, among 29 teams targeting seven product categories including the Samsung Galaxy S26. Nobody attempted the iPhone 17, and the payout comfortably beat the $1,024,750 paid for 73 zero-days at the 2025 event, all of which vendors now have to patch. Source: BleepingComputer Verified: True

A Booz Allen Hamilton study found that frontier AI models can autonomously attack operational technology and industrial equipment, succeeding in all eight scenarios tested in its OT lab. In one run, the agents moved from a perimeter compromise to actions inside an industrial control network in just over 16 minutes, and in another they moved a robotic arm within minutes. The lab, modelled on a multi-vendor manufacturing facility, required human approval before any exploit or physically impactful action. Booz Allen warned that AI agents may outpace organisations that have not implemented foundational OT security, leaving defenders only minutes to detect and stop an intrusion. Source: The Register Verified: True

Push Security has uncovered a campaign dubbed “Adception” that abuses Bing click-tracking redirects inside Google search ads to push a fake Claude installer for macOS. Victims are routed through a compromised WordPress site to claude-desk-code[.]com, where a copy button places a malicious ClickFix command on the clipboard. The command decodes a Base64 URL, downloads a payload and pipes it straight into zsh, while referrer and header checks cloak the attack from researchers. Push links the activity to a reusable ClickFix toolkit it tracks as AcSig, showing how criminals are exploiting demand for AI coding tools. Source: BleepingComputer Verified: True

Zenity Labs researchers showed that a single prompt could pull temporary IAM credentials out of AWS Bedrock AgentCore agents by reaching the Instance Metadata Service. They said the Firecracker microVMs lacked sufficient network isolation and that the default AgentCore role was overpermissioned across every agent in a region, letting stolen credentials read sessions, write memories and fetch Secrets Manager secrets. AWS moved AgentCore to IMDSv2 only in February and Zenity confirmed the remaining issues were addressed by late September. Amazon nonetheless says the research misrepresents documented behaviour and that developer error would be required for the attack. Source: The Register Verified: True

Enterprise Infrastructure

HPE networking chief Rami Rahim, the former Juniper CEO, says AI-driven “self-driving networks” already resolve roughly 70 to 80 percent of trouble tickets without human involvement. He predicts that within two to three years no network issues will need a human, apart from physically swapping failed hardware. HPE, which closed its Juniper acquisition in July 2025, is extending the Mist-derived AIOps technology across its hybrid cloud portfolio. The claim sets an aggressive benchmark for rivals such as Cisco and signals how quickly vendors expect AIOps to reshape network operations staffing. Source: The Register Verified: True

Norwegian startup Vegalabs says it was hit with a $17,600 pre-tax bill for running Claude in Microsoft Foundry, usage it expected its Azure startup credits to cover. Microsoft’s sponsorship terms exclude Anthropic models bought through Azure Marketplace, and the company’s refund request then bounced between Microsoft and Anthropic support. Vegalabs admits it missed the exclusion and set no budget alert, but argues the interface did not make the separate billing clear, and $21,168 in unused credits later expired. The case highlights the billing pitfalls of multi-vendor model marketplaces as hyperscalers resell third-party AI models. Source: The Register Verified: True

Policy & Regulation

The US Federal Motor Carrier Safety Administration has granted a five-year exemption that lets driverless trucks skip a rule requiring reflective warning triangles to be placed within 10 minutes of a breakdown. Aurora Innovation, Kodiak AI and other autonomous trucking developers can instead use cab-mounted warning beacons. Aurora had fought the requirement through an initial rejection and a case at the D.C. Court of Appeals while operating under a temporary waiver. Removing the rule clears a long-running regulatory obstacle to scaling fully driverless freight on US highways. Source: TechCrunch Verified: True

Amazon says it will stop using nondisclosure agreements when negotiating data center deals with local governments, following a similar pledge by Microsoft earlier this year. The shift comes as community opposition hardens: New York State has imposed a roughly one-year moratorium on permits for large data center projects tied to an environmental review, and San Francisco has approved its own moratorium. Other cities are weighing outright bans. The industry is betting that more transparency can blunt a backlash that increasingly threatens the AI infrastructure buildout. Source: TechCrunch Verified: True

India’s Ministry of Communications has rejected Elon Musk’s claim that Reliance chairman Mukesh Ambani is blocking Starlink, calling the satellite regulatory framework “fair and non-discriminatory”. Starlink still lacks final approval for commercial service despite key clearances, and the ministry says it sits at broadly the same regulatory stage as two other licensed operators. India chose administrative spectrum allocation, as Starlink wanted, over the auction Reliance Jio had pushed for. Telecom minister Jyotiraditya Scindia said India “does not allow a monopoly in any sector”, leaving the launch in limbo amid an escalating public feud. Source: TechCrunch Verified: True