Record 1,411-Flaw Patch Tuesday Lands as Microsoft Bets Gigawatts on Maia 300

AI & Machine Learning

Anthropic says Claude now writes so much of its own code that conventional source control buckled, forcing the company to build a replacement. Daily merged code changes grew from roughly 2,500 in May 2026 to more than 30,000 by September, and its main branch has swollen to about 100 GB with around 25 million CI checkouts per day — traffic Anthropic says would amount to over 600 PB of git transfers daily. The answer is Scion, an in-house centralized monorepo version-control system, built with Claude alongside a new code-review interface called Antique, a code-search tool and a source-control IAM layer. Anthropic says Scion is tailored to its own needs and will not be open sourced, and that its engineers’ main job has shifted toward telling agents “no” when they violate core system constraints. The disclosure is one of the clearest pictures yet of how agentic coding at scale strains developer infrastructure built for human-paced commits. Source: The Register Verified: True

Apple researchers have described Minions, an internal system that pools idle Apple Silicon GPUs across the company’s fleet of Macs into what they call a dynamic, distributed virtual GPU cloud for machine-learning inference. Apple says some internal inference jobs previously sat in queues for more than ten hours, whereas with Minions they can often start within minutes. The architecture comprises a Minion Server, a PostgreSQL metadata store, an Executor running on each Mac and a Watchdog that reassigns tasks when a machine stops responding, with results pushed to S3 and monitored in Grafana. Unlike Thunderbolt 5 RDMA clustering on the newest Mac mini and Mac Studio, Minions is designed to harvest spare capacity rather than run single giant models. The work signals Apple squeezing more AI compute from hardware it already owns rather than relying solely on Nvidia-based clusters. Source: The Register Verified: True

Consumer Hardware

Google now lets Android users run their own vibe-coded apps through Google Play without publishing them to the Play Store. People build an app in Google AI Studio and then launch it on their phone with their standard Google account, and the resulting personal app stays out of Play search and listings, visible only to its creator. The feature is launching for U.S. users aged 18 and over, and the apps must still comply with existing Google Play policies. Google says creators will later be able to share such apps with trusted friends, and an app could eventually graduate to the public store after trust-and-safety review. The move turns Play into a distribution channel for single-user software, a category that barely existed before AI-assisted app building went mainstream. Source: TechCrunch Verified: True

Meta is rolling out “Your Algorithm” on Facebook, an AI-powered tool that lets users describe in their own words what they want to see more or less of in Feed and Reels. The system can ask follow-up questions to refine its understanding, and adjustments are reflected in recommendations in real time. Users reach the tool from the three-dot menu on posts, which also carries “Interested” and “Not interested” controls. The feature debuted on Instagram first, while Threads offers a similar tool called “Dear Algo.” The launch reflects mounting regulatory and user pressure on platforms to give people more direct control over opaque recommendation systems. Source: TechCrunch Verified: True

Cybersecurity

Microsoft’s October 2026 Patch Tuesday fixes a record 1,411 vulnerabilities, a total the company attributes to its expanding use of AI tools to discover bugs. Seventy flaws are rated critical, most of them remote code execution issues. Three are zero-days: CVE-2026-96951, an actively exploited Windows Shell bug that bypasses Mark of the Web protections, plus publicly disclosed flaws in the .NET Framework (CVE-2026-108398, a WDAC bypass) and MessagePack-CSharp (CVE-2026-92707, denial of service). Other critical fixes cover Active Directory Domain Services remote code execution, AD FS spoofing and Azure App Service. The release is also the final security update for Windows 11 24H2 Home and Pro, leaving administrators with both an unprecedented patch load and an upgrade deadline. Source: BleepingComputer Verified: True

Ivanti is urging customers to patch CVE-2026-104935, a high-severity authentication bypass zero-day in its Connect Secure remote-access gateway that can be exploited remotely without credentials or user interaction. Affected releases include 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Volexity reports that a threat actor it tracks as UTA0576 has chained the bug with two other flaws since at least October 3 to achieve unauthenticated root-level code execution. Ivanti has fixed two of the chained vulnerabilities but is still working on the privilege escalation bug used in the same chain. The company recommends upgrading immediately and running its Integrity Checker Tool regularly, as Connect Secure appliances remain a favoured entry point for state-backed intruders. Source: BleepingComputer Verified: True

Docker has disclosed CVE-2026-105445, a critical Docker Hub flaw that let attackers hijack access to other users’ container repositories. An attacker could create an account and personal access token, convert the account into an organization and name a victim as its owner, transferring the token to the victim’s identity without rotating its secret or seeking consent. Depending on scope, that token could pull, push or delete images in the victim’s repositories and organizations, creating a clear software supply-chain risk. Docker confirmed the report on September 30, shipped a fix in under four hours and says a review of 304,000 pushes made with transferred tokens found no evidence of exploitation. Transferred tokens were deactivated on October 8, and Docker now requires explicit consent before anyone is named an organization owner. Source: BleepingComputer Verified: True

Enterprise Infrastructure

Microsoft has unveiled Azure Maia 300, its next-generation in-house AI accelerator, and plans multi-gigawatt deployments beginning in 2027. A full 96-accelerator rack is claimed to deliver up to seven times the rack-scale token throughput of Maia 200 and 40 percent more tokens per megawatt than leading GPU-based systems. Each chip carries eight HBM4 stacks with up to 18 TB/s of peak memory bandwidth, using an inference-first design aimed at long-context, decode-heavy workloads. The chip was announced in a blog post by Scott Guthrie, Microsoft’s EVP for Cloud and AI, with more detail promised at Ignite 2026 next month. The scale of the rollout marks Microsoft’s most aggressive push yet to reduce its dependence on Nvidia for serving AI models. Source: The Register Verified: True

Policy & Regulation

The U.S. Justice Department says North Korean IT workers are increasingly recruiting American facilitators to help them infiltrate U.S. companies, and it has moved against the networks supporting them. Prosecutors indicted and arrested at least two people and raided more than 40 suspected “laptop farm” locations in Texas, seizing over 180 computers that employers had shipped to new hires who were actually North Korean operatives using stolen identities. At least 70 companies across healthcare, cyber support, retail, communications and manufacturing in Ohio, 16 other states and Washington D.C. were affected, with about $3 million in funds stolen. A companion FBI advisory warns that “thousands” of state-controlled North Korean IT workers are employed at Western firms. CrowdStrike assisted the investigation, underscoring how remote hiring has become a sanctions-evasion channel for Pyongyang. Source: TechCrunch Verified: True

The International Monetary Fund’s October 2026 Global Financial Stability Report warns that markets are increasingly exposed to an AI-driven correction if the profits investors expect from heavy AI spending fail to materialise. The fund flags concentrated risk from tech giants borrowing billions, investors crowded into a handful of companies and circular financing between AI firms that could spread distress across the sector. It also highlights cyber risk, noting that more than 70 percent of vulnerabilities exploited so far in 2026 were abused before or on the day of public disclosure, and that more capable AI models may accelerate exploitation. The IMF stops short of predicting a collapse, saying stress tests suggest banks could withstand a severe downturn, though weaker institutions are more exposed. It urges regulators to watch leverage, investment concentration and the financial system’s reliance on a few cloud providers. Source: The Register Verified: True

A U.S. federal judge has granted Apple expedited access to OpenAI hiring records in Apple’s trade-secrets lawsuit over former employees who moved to OpenAI. Judge Edward Davila ordered OpenAI to produce interview materials for ex-Apple staff who applied to its consumer hardware and robotics groups, along with private LINE messages between named individuals including Chang Liu and Alyssa Peng. He also approved depositions of Liu, Peng and OpenAI chief hardware officer Tang Yew Tan, all former Apple employees, giving OpenAI five days to hand over already-collected material and 14 days for the rest. Apple’s July 2026 complaint alleges departing staff took confidential files on unannounced products and coached others on what to bring to OpenAI interviews. The judge rejected broader requests covering OpenAI’s research on metal finishes and power management, but allowed Apple to narrow them and try again. Source: TechCrunch Verified: True