Zyxel Zero-Day Hijacks 996 Switches as Apple Starts Scanning iCloud Links

AI & Machine Learning

Meta has acquired Conductor, a 2024-founded startup whose tool lets engineers run several AI coding agents side by side in parallel workspaces. Conductor CEO Charlie Holtz confirmed the company is joining Meta and teased “something new” by early next year, while Meta confirmed the deal but disclosed no price. Conductor’s cloud service shuts down on November 20, after which users’ cloud data will be deleted, though core features keep working into early 2027. Notably, the agents Conductor orchestrated came from Anthropic and OpenAI rather than being built in-house, so the deal buys Meta orchestration know-how rather than a model. Source: TechCrunch Verified: True

A new Gartner paper, “Open-Weight Models Will Run 90% of Enterprise Agentic Workflow Steps”, predicts that by 2030 nine in ten operational agent workflow steps inside enterprises will run on open-weight models. Analysts Mark Petty and Raymond Paquet found an open model can cost a quarter of the cheapest closed model at the same benchmark score, and as little as a twentieth of a frontier model used on every step, though they put realistic savings closer to 5-6x. Their central argument is that the agent harness, not the underlying model, is becoming the real source of value. Frontier models, in this view, become an R&D expense rather than the default engine for routine agent work. Source: The Register Verified: True

Consumer Hardware

Apple has quietly changed iCloud so that anything shared through an “Anyone with the Link” public link will be checked by Apple for harmful content, according to a support page published this week. The change arrives with iOS, iPadOS, macOS and visionOS 27.3, currently in developer beta with general release expected in December. Link-shared items lose end-to-end encryption even when Advanced Data Protection is turned on, and Apple says it may remove content, block accounts and involve law enforcement. Apple has not defined “harmful content” or said whether review is automated or human, which has privacy advocates uneasy. Source: The Register Verified: True

Nothing CEO Carl Pei says the company’s first “AI-native product” will ship in December. Pei described it as a productivity tool that “has no new screen” and “couldn’t have been an app”, but gave no name, price or form factor. Nothing has previously signalled plans for AI smart glasses and earbuds, so the device could land in either category or something new. It joins a crowded field of AI-first gadgets racing to define a category beyond the smartphone. Source: TechCrunch Verified: True

Snap said in its Q3 2026 earnings that paid subscriptions across Snapchat+, Memories Storage and Lens+ have passed 30 million, up 5 million since February. CEO Evan Spiegel said Lens+, priced at $8.99 a month, exceeded expectations on the strength of its AI-powered features. User growth was softer: daily actives reached 495 million against the 499 million analysts expected, and shares fell 12%. The results show subscriptions becoming a meaningful second revenue line for a company long dependent on ads. Source: TechCrunch Verified: True

Cybersecurity

Zyxel has patched CVE-2026-107441, an out-of-bounds write in the web interface of ten GS1900-series switch models that lets unauthenticated attackers run OS commands. GreyNoise says a suspected Chinese-speaking actor it tracks as Kapibala compromised about 996 switches across 48 countries. The attacks were first blamed on CVE-2026-7273, patched in June, until Binarly found the exploit still worked against patched firmware and was hitting a separate flaw. Zyxel shipped fixed firmware on October 22 and published its advisory on November 3, so owners who patched for the earlier bug need to update again. Source: BleepingComputer Verified: True

A cyberattack on November 2 through refrigeration supplier Coolworld Rentals changed temperature and defrost settings at three facilities run by France’s national blood service, the Établissement Français du Sang. The supplier says attackers exploited a third-party component in its remote monitoring software, affecting a limited number of units. EFS says no health impact has been identified and no blood products were lost, and it is working with ANSSI and the Ministry of Health. The incident follows October attacks that tampered with refrigeration controllers at hundreds of French supermarkets. Source: BleepingComputer Verified: True

Researcher Gal Weizman of Forever Security has disclosed “ThisBash”, a flaw chain in which a browser extension controlling claude.ai can make Claude Desktop execute code, including on another machine signed in to the same account via Claude Dispatch. Anthropic closed the May report as a duplicate with no bounty or CVE, saying Dispatch would be retired at the end of October, but it was still in limited beta as of October 30. The proof of concept uses a six-step chain to install an npm package. The risk is cross-boundary: in six corporate environments studied, 18% to 71% of staff used personal accounts that could bridge work and home machines. Source: The Register Verified: True

Enterprise Infrastructure

Google has explained the October 20 outage in its London europe-west-2-b zone that hit services at Lloyds, HSBC, Royal Mail and Revolut. Its November 4 incident report says a PLC misconfiguration and a voltage-sensing design flaw stopped the backup generators from receiving their automatic start signal. The trigger was an external cable failure on one power feeder while the second feeder’s breaker was still open for repairs after an October 14 load test, leaving UPS batteries with only about five minutes of runtime. Google says it will automate customer communications and expand platform-wide testing of failover systems. Source: The Register Verified: True

Broadcom’s VMware is returning to the low end of the market with vSphere Express, a per-core subscription covering up to 128 cores sold through distributors’ cloud marketplaces. It includes vMotion, automated VM restart, the distributed switch, non-disruptive patching and TPM support, but each instance is managed separately with no central management. VMware says pricing is significantly lower than its VVF and VCF bundles and that it does not want customers running it across thousands of cores. The move is aimed at smaller customers who have been eyeing alternatives such as Proxmox since Broadcom’s licensing overhaul. Source: The Register Verified: True

At its TechEd conference SAP added native Apache Iceberg support to Business Data Cloud, along with a universal catalog built on Apache Polaris and the SQL engine from Dremio, which it bought in May. SAP also expanded its Databricks partnership and promised zero-copy data sharing with Databricks, Snowflake, Google, AWS and Microsoft, while continuing to support Delta Lake. The company plans to bring its Joule assistant and Databricks Genie together at a later date. The shift signals SAP opening up data flows in both directions rather than keeping ERP data locked inside its own stack. Source: The Register Verified: True

Policy & Regulation

Datacenter restrictions emerged as one of the few bipartisan winners of the US midterm elections. Data Center Watch found that of 74 candidates in the 36 states electing governors, 43% backed a ban or moratorium and 51% backed regulation or conditional development, and in Texas moratorium supporter Gina Hinojosa defeated Governor Greg Abbott. At the local level, 43 of 46 municipalities voting on tighter datacenter rules approved them. With roughly $12 million spent on social media ads mentioning datacenters this cycle, the vote sets up harder permitting fights for AI infrastructure builders. Source: The Register Verified: True

AI-industry super PACs had a mixed night after pouring tens of millions into the midterms. Leading the Future spent $27.38 million in primaries, including $8 million against New York’s Alex Bores, who lost, and says it will keep spending in 2028. American Mission and Building the Future spent $4.8 million backing South Carolina Senate candidate Darline Graham, who lost, while Anthropic-backed Public First gave $3 million to a PAC supporting California’s Scott Wiener, who was leading at publication. The results show AI money is now a significant force in US elections, with rival camps funding opposing views on regulation. Source: TechCrunch Verified: True