Weak eMudhra Keys Pulled From Browsers as DHS Purges DeepSeek

AI & Machine Learning

OpenAI says GPT-6.1 Sol is dramatically better at modernising legacy code. In tests that migrate COBOL programs to C++, Java, Kotlin, Python or Rust without changing behaviour, GPT-6.1 Sol hit 86.6% accuracy at low reasoning effort, against 5.4% for GPT-5.6 Sol, at 61% of the older model’s API cost, and 97.9% at higher effort. On OpenAI’s MultiLangBench, which asks models to build a SQLite-compatible engine across 20 languages, GPT-6 Astra averaged an 87.4% pass rate, with COBOL jumping from 10.9% to 72.1%. OpenAI concedes the migration evaluation is nearing saturation, and production migrations would still need expert review and testing. The result matters for banks, insurers and governments still running decades-old mainframe code with a shrinking pool of people who can maintain it. Source: BleepingComputer Verified: True

Google has open-sourced TorchTPU, a version of the PyTorch toolkit that lets existing PyTorch apps run on its Tensor Processing Units with a configuration change rather than a rewrite. The release lands a day after Amazon shipped TorchNeuron for its Trainium chips and submitted code to decouple PyTorch from Nvidia hardware. Google worked with Meta, Hugging Face and other tool makers on the project and also launched a TPU agent suite to help developers migrate and fix errors. With PyTorch reportedly used by about 85% of AI apps, the two hyperscalers are now attacking the software layer that has kept developers tied to Nvidia GPUs, though switching hardware will not happen automatically. Source: TechCrunch Verified: True

Consumer Hardware

OpenAI is rolling out locked chats in ChatGPT, letting users hide individual conversations behind a four-digit PIN or Face ID and Touch ID on supported devices. Locked chats move into a separate section away from regular history, pinned chats and search results, and when Memory is on they keep their own memory that does not feed the main profile. OpenAI is clear that locking is a screen-privacy feature, not end-to-end encryption, and that resetting the PIN permanently deletes all locked content. The feature covers Free, Go, Plus, Pro, Business, Enterprise and Edu plans, excluding ChatGPT for Healthcare, and began rolling out on 20 October. Source: TechCrunch Verified: True

Google is bringing “Personal Intelligence with Gemini” to the car, letting its in-vehicle assistant draw on Gmail, Google Calendar, YouTube, Maps, Search history and other connected services. The feature launches in Android Auto immediately and expands to cars with Google Built-in over the coming months. It is opt-in, drivers can choose which apps to connect, and it can be switched off at any time. Google pitches it as handling chained natural-language requests, such as asking for a flight’s gate and then whether it is still on time, turning the dashboard into another front in the personal-assistant race. Source: TechCrunch Verified: True

Cybersecurity

Mozilla, Google and Apple have blocked eight intermediate certificates from Indian certificate authority eMudhra after a researcher found their P-384 private keys were so weak they could be recovered almost instantly. eMudhra blamed a script error that generated a second set of weak keys in April 2025, which were then mistakenly used for signing. Firefox revoked the certificates through OneCRL and Chrome blocked six TLS-authorised intermediates on 17 October, with Apple following on 19 October. Anyone holding the keys could have impersonated websites and intercepted encrypted traffic; there is no evidence of abuse, but software with its own trust stores or no revocation checks may still trust the certificates until patched. Source: BleepingComputer Verified: True

PHP’s security team has warned administrators of two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, whose embargoed details have leaked. PHP rates each 9.2 under CVSS v4.0, while watchTowr says they reportedly score 10.0 and are believed to affect PHP 5 through 8, though PHP has not confirmed the affected versions. Emergency updates are scheduled for 21 October at 14:00 UTC and may ship sooner if details go public or exploitation appears. Given how much of the web runs on PHP, admins are being told to line up patch windows now. Source: BleepingComputer Verified: True

Attackers hijacked a developer’s GitHub account and backdoored OVHcloud’s open-source CLI, publishing trojanised versions 0.11.0 through 0.15.0 on 19 October laced with an infostealer built to pull secrets from disk. Versions 0.10.0 and the latest 0.16.0 are clean, but anyone who ran an affected build on macOS, Linux or Windows should treat every secret on that machine as compromised. OVHcloud found GitHub’s release immutability setting had been disabled, letting a privileged account alter existing releases without passing CI/CD checks, and has since switched it on. Researchers tied the attack to the GlassWorm campaign, the latest in a string of supply-chain hits on developer tooling. Source: BleepingComputer Verified: True

Enterprise Infrastructure

A “power event” in Google Cloud’s europe-west2-b zone, one of three availability zones in its London region, knocked out multiple services from 06:08 UTC on 20 October. BigQuery Data Transfer Service, Cloud Run, Google Kubernetes Engine and Cloud Filestore were among the affected products, and customers including Lloyds Bank, HSBC and Royal Mail reported problems. Google said the power issue was mitigated and prioritised recovering existing workloads, with most customers restored by 14:03 UTC. A full incident analysis has been promised, and the outage is a fresh reminder of how much UK financial infrastructure now depends on a single cloud zone. Source: The Register Verified: True

Meta has revealed that more than 11% of the GPUs in its Prometheus supercluster in New Albany, Ohio, are dead or deliberately idle as hot spares. The company reserves eight spare GPUs in every 72-GPU NVLink domain so a single failed chip does not take down a whole Grace Blackwell rack, and combines that with data-parallel redundancy, asynchronous checkpointing and NVLink telemetry. Meta says interruptions fell from roughly 1,000 per day per 8,000 GPUs to about 11 over the past year, with over 85% goodput for pretraining and over 90% for reinforcement learning on Muse Wonder. With Prometheus heading toward a gigawatt and around a million accelerators, reliability engineering is becoming as important as raw chip count. Source: The Register Verified: True

Policy & Regulation

The US Department of Homeland Security has ordered federal civilian agencies to stop using DeepSeek products and strip them from government systems, covering affiliates and third-party services built on DeepSeek technology. Agencies must immediately exclude the products from procurement and remove them from IT systems, with any exception requests due to CISA within 60 days. DHS cites the risk that the Chinese government could access DeepSeek infrastructure, collect personal data and obtain sensitive government information, alongside previously reported app security flaws. The order, published in the Federal Register on 20 October, applies only to agencies under DHS authority and is not a ban on private or consumer use. Source: BleepingComputer Verified: True

Anthropic has been shopping a draft federal AI safety bill that would let a model’s release be blocked over a “foreseeable, imminent risk” of killing more than 50 people or causing over $1 billion in property damage via bioweapons, loss of developer control or cyberattacks. Registered independent evaluators, who could be paid by AI labs as long as payment is not contingent on results, would have 72 hours to alert the Commerce Department after finding imminent danger. Commerce would then have to ask a Washington, D.C., judge to halt the release, and federal agencies could not act alone. The thresholds echo California’s SB 53, and the proposal lands as Nvidia’s Jensen Huang argues no new AI laws are needed. Source: TechCrunch Verified: True

The UK Financial Conduct Authority wants firms to report significant AI failures and near-misses as part of their incident reporting. Chief data officer Jessica Rusu told Bloomberg’s UK Policy Series that the expectation would extend the FCA’s existing major-incident rules, particularly as autonomous AI agents spread through financial services. She argued that poorly governed AI can cause consumer harm, cyber vulnerabilities and operational failures at greater speed and scale, so more autonomy demands clearer accountability. No timetable was given, and the government has yet to commit to adding AI-specific measures to the Cyber Security and Resilience Bill. Source: The Register Verified: True