01 — Cloudflare
Cloudflare says eMudhra's weak certificate-signing keys enabled certificate forgery within hours of public disclosure. It found no evidence of interception of its own connections, but its probes suggest older and embedded browsers still accept compromised certificate chains. The sample is heavily skewed toward challenge-page traffic and possible bots, so it cannot establish Internet-wide exposure.
Why it matters
Systems that retain trust in the compromised keys can accept forged certificates, making trust-store updates a practical security priority.
Read the source →02 — The Verge
Campaigns can obtain phone numbers through data brokers combining voter rolls, web tracking, and loyalty programs, The Verge reports. Consumer advocates recommend reporting unwanted messages and avoiding unfamiliar links, but warn that blocking individual numbers offers limited relief. Their broader argument: stopping the flood requires action against the data trade and stronger enforcement.
Why it matters
Your shopping and browsing data can become political targeting material, with few effective ways to withdraw it.
Read the source →03 — Ars Technica
A Science study finds that Manx shearwaters experience jet lag during long ocean journeys, Ars Technica reports. Because the birds navigate using the Sun, a mismatch in their internal clocks measurably skews their compass.
Why it matters
The finding connects an animal's internal clock to navigation errors during travel across time zones.
Read the source →04 — Hacker News
Parameter says it demonstrated a malicious ChatGPT share that ran code inside another user's signed-in session, retrieved private conversation content, and sent data off-site. The attack combined an HTML Preview with unchecked messages to a graph's math library. Researchers reproduced a version requiring only opening the link and say OpenAI fixed the issue on October 26.
Why it matters
Individually isolated features can still expose private data when a trusted component accepts messages from an untrusted frame.
Read the source →05 — Ars Technica
NASA is asking companies how they could raise Hubble's orbit, service the telescope, or guide it into a controlled reentry, Ars Technica reports. Responses are due November 30, including proposals to boost it to at least 600 kilometers. Without intervention, the observatory is expected to reenter the atmosphere in the early-to-mid-2030s.
Why it matters
Commercial servicing could preserve a working scientific instrument, but NASA is gathering options rather than committing to a rescue.
Read the source →06 — The Verge
Apple says Apple Intelligence will reach China through an iOS 27.3 beta on November 4, followed by a full release scheduled for December, The Verge reports. Initial features include translation, writing tools, notification summaries, and photo object removal. Some experiences will support Alibaba's Qwen chatbot; the new Siri AI is excluded.
Why it matters
The rollout expands Apple's AI features into China while giving users a different chatbot integration and a narrower initial feature set.
Read the source →07 — Cloudflare
Cloudflare has made Private Origins generally available, routing public requests over an existing Cloudflare One connection to private servers. The company says customers can apply its firewall, caching, bot management, and Workers without opening inbound firewall ports. Access requires an account entitlement and network setup; Argo Smart Routing remains unsupported.
Why it matters
Teams can put existing application controls in front of private backends without giving those servers a public address.
Read the source →08 — Simon Willison
Drew Breunig embedded a working NES 6502 CPU emulator into Qwen3.5-4B's weights, Simon Willison reports. It can run NES games, though very slowly. Breunig says he used Opus to help build the system, including finding an existing CPU conformance test suite.
Why it matters
It's a surprising computing experiment whose appeal is the unusual implementation, with speed remaining a clear limitation.
Read the source →