Volt Typhoon’s Silent Train Exposed as Apple Ships a Touchscreen MacBook Pro

AI & Machine Learning

Nvidia has released Nemotron 3.5 Transcribe, a free, open-weight 30-billion-parameter speech recognition model, alongside version 2 of its open Granary speech dataset. The model transcribes up to 40 languages, translates 31 languages to and from English, handles recordings up to an hour long and separates up to eight speakers, though it works on recorded audio only rather than live streams. Nvidia says it tops rivals on benchmarks including Hugging Face’s Open ASR Leaderboard and that it fits on a single chip, from a Jetson AGX Thor or DGX Spark up to Blackwell data-centre parts. Developers can fine-tune it for industry jargon with Nvidia’s NeMo Speech tooling, making it a notable open alternative as voice becomes a primary interface for AI agents. Source: TechCrunch Verified: True

Anthropic launched a suite of “smart reports” that let enterprise managers see what a team produced with Claude over a chosen period, what it cost, and where workflows broke down, combining internal analytics with employee surveys and adding recommendations for improvement. The company is also introducing pooled group budgets so teams can manage token spend collectively, and says the reporting data will not be used for model training by default. The launch targets the return-on-investment question that large customers keep raising, even as Anthropic tells investors it reached an operating profit in Q2 and a 900% net revenue retention rate. A Jellyfish study cited alongside the launch found Anthropic-powered tools now account for nearly a third of proposed code changes across its customer base, with spend up tenfold this year. Source: TechCrunch Verified: True

Consumer Hardware

Apple launched its first touchscreen MacBook Pro, offered in 14-inch and 16-inch sizes with M5 Pro or M5 Max chips, up to 128GB of unified memory and up to 16TB of storage. The new PROLED XDR display reaches 2,000 nits peak brightness for both HDR and SDR, swaps the notch for a Dynamic Island-style cutout, and sits on a redesigned hinge that keeps the panel steady when touched. Despite the added touch layer, both models are lighter than their predecessors at 3.0 and 4.0 pounds, and they keep three Thunderbolt 5 ports, HDMI, an SDXC slot and MagSafe. Pricing starts at $2,899 and $3,399, with preorders opening October 30 and availability on November 6, a day after Apple unveiled a cheaper M6 14-inch model. Source: TechCrunch Verified: True

Xreal opened orders for Aura, its Android XR glasses built with Google and powered by Qualcomm’s Snapdragon Reality Elite platform in a tethered, phone-like compute puck. The 95-gram glasses use Sony micro-OLED displays at 1200p and 120Hz with a 95-degree field of view, Bose-tuned audio, and Gemini as an assistant that can explain what is on screen. They can also plug into a computer or handheld console over USB-C to act as a large virtual monitor, and launch with Google Play apps plus XR titles from the NBA, NASCAR and others. Aura costs $1,279 or $1,499 depending on configuration, with launch discounts through December, and ships by mid-November in the US, Canada, Japan and South Korea. Source: TechCrunch Verified: True

Cybersecurity

Lumen’s Black Lotus Labs has detailed “Silent Train,” a constantly refreshed relay framework that Chinese state-sponsored group Volt Typhoon uses to mask the origin of zero-day attacks. Traffic is routed through overseas VPS infrastructure and chains of hijacked routers, including Intelbras modems abroad and Netgear Orbi devices as US hops, with sessions typically lasting under eight hours before operators wipe tools and keys. The researchers confirmed at least four zero-days used against targets in telecoms, government, defence, utilities, MSPs and aviation, including flaws in VeloCloud Orchestrator and Cisco Catalyst SD-WAN. They urge organisations to lock down centralised management systems, restrict internet exposure of admin interfaces and keep longer log retention to catch the short-lived intrusions. Source: BleepingComputer Verified: True

The Brotli decoder flaw first patched in emergency releases earlier this week has now moved to confirmed in-the-wild exploitation, with CISA adding CVE-2026-111497, dubbed Node2Shell or HTTP2Shell, to its Known Exploited Vulnerabilities catalogue. The out-of-bounds write lets unauthenticated attackers send a crafted Brotli-compressed stream that can crash systems, leak memory and in some cases achieve remote code execution in Node.js and other HTTP stacks using vulnerable implementations, while Microsoft has shipped an emergency .NET fix for a related privilege-escalation path. Federal civilian agencies must patch by November 10. CISA advises restarting affected processes and rebuilding container images after patching, or blocking Brotli-compressed requests at the edge where patching is not yet possible. Source: BleepingComputer Verified: True

A hacker calling themselves “Department of Peace” claims to have stolen personnel and access data on more than 40,000 Department of Homeland Security staff from the Okta single sign-on system the department uses, including roughly 21,000 CBP and about 10,000 ICE and HSI employees. The records include names, job titles, work phone numbers and emails, plus Active Directory group memberships that reveal which tools staff can access, such as Penlink surveillance software and the Mobile Fortify facial-recognition app. TechCrunch verified part of the dataset against known employee names, and DHS says it is aware of a potential breach and working to address it. Okta says it has no evidence its own systems were compromised. Source: TechCrunch Verified: True

Sony Network Communications, which runs Japan’s So-net ISP, disclosed a breach of its member database exposing 2,585,481 customer records, including names, phone numbers, email addresses, dates of birth and internet connection IDs. The haul includes about 443,000 records belonging to NTT Docomo’s Docomo Hikari service, which Sony operates under contract, and a separate set of 54,401 email addresses was exposed together with account passwords. The intrusion happened on October 19 and was detected four days later, after which Sony shut down the affected servers and notified Japan’s privacy regulator. Neither company has confirmed misuse yet, but Docomo is warning customers about follow-on phishing. Source: BleepingComputer Verified: True

US, German, Dutch and UK law enforcement have dismantled Virtualine, a bulletproof hosting service that advertised on cybercrime forums and promised to shield customers from abuse complaints and police requests. The FBI seized its main domain while Dutch police took dozens of physical servers in Limburg offline, knocking out hundreds of virtual machines and recovering data on more than 3,000 customers for follow-up action. Blockchain analysis from TRM Labs attributes about 5% of Virtualine’s financial flows to ransomware groups and around 44% to a Russian drug marketplace, with payments also linked to the StealC infostealer. Authorities say the service, which operated under several brand names, had been enabling phishing, spam and carding since at least 2022. Source: BleepingComputer Verified: True

Enterprise Infrastructure

Microsoft disclosed Azure’s quarterly revenue in dollars for the first time, reporting $33.2 billion for the July-to-September quarter, up 48% year over year and ahead of both its own 44-45% guidance and analyst estimates of $32.3 billion. Azure now makes up roughly 36% of Microsoft’s $92.3 billion quarterly revenue and sits inside a new Agents and Infra segment that brought in $76.8 billion. The disclosure invites direct comparison with Google Cloud, which posted $30.7 billion for the same period while growing roughly twice as fast. Amazon reports AWS results on Thursday, where it remains the largest cloud provider. Source: TechCrunch Verified: True

GitHub used its Universe conference to announce it is adding four million CPU cores and 160 petabytes of high-speed storage after a year of outages driven by AI agents flooding the platform with code. Commits hit 7.4 billion in September, about five times the volume of a year earlier, and reconstructed status data shows 90-day availability sank to around 84% in May. GitHub is re-architecting to separate compute from storage for an expected 35x throughput gain and migrating to a multi-region Azure deployment due to finish early next year. It also made its multi-model Copilot Fusion router generally available and extended Copilot access to all Enterprise users without per-seat fees, charging for tokens instead. Source: The Register Verified: True

Fujifilm will quintuple production of LTO tape at its Odawara plant in Japan, investing about ¥10 billion (around $64 million) over the next two years. The company says generative AI and cloud services are driving exponential growth in data volumes, including training and inference data that needs cheap, durable archival storage. The investment centres on tenth-generation LTO cartridges with 30TB or 40TB native capacity and 400MB/s transfer speeds. LTO shipments dipped to 160.3 exabytes in 2025 from a 2024 record, but sales recovered in the second half and the LTO Program expects a new record this year. Source: The Register Verified: True

Policy & Regulation

The US Department of Energy has conditionally committed up to $5 billion in loans to Constellation Energy to add about 1.1 gigawatts of nuclear output by uprating 11 reactors across eight plants in Illinois, Maryland and Pennsylvania. Most or all of the extra power from seven of those plants is already contracted to Google, Amazon or Meta for AI data centres, including Amazon’s 20-year deal for Calvert Cliffs and Meta’s effective purchase of the entire Clinton plant. The DOE framed the loan as delivering affordable, reliable power to homes and businesses, though there is no evidence the added capacity will lower residential rates. Constellation says the financing could reduce project costs, savings that may accrue to the company, the hyperscalers or both. Source: TechCrunch Verified: True

A report from the non-profit Good Jobs First argues Intel’s property tax breaks have cost US communities more than $1.2 billion in lost revenue since 2015, with schools absorbing much of the shortfall. In Hillsboro, Oregon, abatements under the state’s Strategic Investment Program exempted Intel from at least $1.14 billion, costing local schools $891 million from 2017 to 2025, while exemptions in Rio Rancho, New Mexico, removed another $99.6 million. The group notes Intel also received CHIPS Act support, later restructured by the Trump administration into a 10% government equity stake, and has cut more than 4,700 jobs at the two sites in three years. It urges other communities to rethink chip-fab incentives, while Intel declined to comment beyond its annual reports. Source: The Register Verified: True