November 9, 2026

On Friday, November 6, at 12:20 PM ET, Google DeepMind reported that AI agents, guided by humans and working with cryptographers at UC San Diego and Inria, found two cheaper ways to attack obsolete 1024-bit RSA keys.

In a measured test, they re-ran a published signature-forgery attack in 391 CPU core-years, versus 1,380 in the original study, about 3.5 times less. A second method, still only estimated and not yet built, would make each additional 1024-bit key about 30 times cheaper to factor after a large upfront cost.

RSA-2048 and larger keys are not affected. The forgery does not recover the private key, and it needs about 4 billion signing queries made in advance. The practical step is still cheap and worth doing: retire any remaining 1024-bit DKIM, SSH, or TLS keys on servers and home gear.

Sources: DeepMind’s writeup on X, and SecurityWeek.

On Monday, November 9, at 8:43 AM ET, Google added two new eighth-generation TPU systems. These are new systems, not new chips.

TPU 8i Max puts two TPU 8i chips in one package, doubling compute, SRAM, and memory bandwidth for long-context agent work. TPU 8tx, on AMD EPYC hosts, keeps data and model weights protected even while in use. Google gave no price or availability date.

Sources: Google’s blog and the X post.

On Monday, November 9, at 1:04 PM ET, Meta released Muse Ember, a small agent model. It is available now on the Meta Model API and in Muse Code as muse-ember-1.0. Meta also says it is on Google Cloud and Oracle Cloud.

It has a 1-million-token context window, can take text, images, audio, and video, and costs $0.10 per million input tokens and $0.50 per million output tokens for requests up to 200,000 input tokens, with higher rates above that. Meta says it scores about like Claude Haiku 5.5 on the Artificial Analysis Intelligence Index at about a third of the cost. That comparison is Meta’s own claim, using Artificial Analysis results.

Sources: Meta’s blog and the X post.

On Monday, November 9, at 5:01 PM ET, OpenAI described Control Room, an internal system that can halt a research job’s model output within 35 seconds. If Control Room itself goes down, model requests are refused.

This is an OpenAI research-infrastructure control, not a product you can use.

Sources: OpenAI’s page and the X post.

• Cloudflare launched Zero Wire, a free curated feed of critical vulnerability briefings, with an RSS feed. It is ready to use, and no Cloudflare account is required. Source: Cloudflare’s blog.
• Cloudflare also added analytics and per-agent allow/block rules for personal AI agents visiting a site.
• Anthropic open-sourced FlashProve, a research prototype that can prove a reply came from a specific model. It is limited to one model and a short context window, and is not production-ready.
• Gemini Omni 1.2 Flash video is generally available: up to 15-second clips, from 360p to 4K.
• Smaller launches: Google AlloyDB Express is in preview, Google Cloud spend caps are generally available, AWS Web Answer on Bedrock AgentCore is generally available, and GitHub published a writeup of its new Git storage system.
• Samsung’s Galaxy Ring sleep-apnea feature is now FDA-cleared. It flags signs of moderate-to-severe apnea; it is not a diagnosis.
• Tesla says it will launch in Argentina on November 20. Elon Musk also said Tesla will add an extra Cybertruck shift to work through the backlog before the line closes mid-2027. That last part is his statement only; I found no Tesla press release. Full Self-Driving was still quiet.

On October 21, researchers disclosed two memory-safety bugs in the PHP engine itself, known as PHP2Shell. They were patched the same day, and on October 26 CISA added both to its Known Exploited Vulnerabilities catalog.

The identifiers are CVE-2026-109618 and CVE-2026-109619. An attacker who isn’t logged in can run code on the server or read server memory, which can hold passwords, tokens, and keys. The site’s own code does not need to be flawed. Wiz, which found the bugs, demonstrated pre-login takeover of WordPress, Drupal, and Joomla, and says every PHP version back to 5.4 is affected by at least one of them.

CISA tells organizations to move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away. Sites on PHP 8.1 or older should be taken offline until they’re upgraded, because those versions get no fix.

Synology published its own advisory, SA-26:14, rated Critical. It was first posted on October 22, about 7:45 AM ET, and last revised on October 31. It lists fixed builds for Synology’s DSM PHP packages from 7.4 through 8.4, plus Calendar and Mail Station. Synology’s PHP 7.3 package gets no fix.

This is real, patched, and being exploited now.

Sources: the CISA alert, Wiz Research, and Synology SA-26:14.

I asked Web Dev to confirm which PHP version each site on the VPS actually runs, and that workers were restarted after any update. I asked Local Dev to check the Synology for PHP, Calendar, or Mail Station, and to flag any PHP 7.3 package.

OpenSSH 10.6p2 and the public disclosure went out on November 5, at 9:14 AM ET. SecurityWeek reported exploitation on November 9. A firm called Previdian first saw attempts on November 6 and last saw them on November 8.

The bug is CVE-2026-123158, scored 8.1. It lets an attacker log into accounts that have no password set, such as root on Alpine, by sending any password of 257 to 1,024 characters. It only affects the SSH server on Linux systems that use musl and have PAM turned off. That covers Alpine, Buildroot, OpenWrt, Yocto, and similar systems, but not typical Ubuntu or Debian machines.

The fix is OpenSSH 10.6p2, or the distro’s patched package. Turning off password authentication (PasswordAuthentication no) also blocks it. So far, botnets and crypto miners are using it. Synology says none of its products are affected.

Sources: the oss-security disclosure, SecurityWeek, and Synology SA-26:16.

I asked Web Dev to check for any musl-based system or container with SSH exposed, and Local Dev to check whether the home router or other network devices run OpenWrt-like firmware with SSH password login on.

On November 4, OpenAI published research from a mid-October scan of the latest Linux kernel. Its automated pipeline reproduced 1,724 vulnerabilities and produced working exploits that let an ordinary local user gain root. Those came down to 948 separate patches, at a cost of about $1.2 million in API credits.

OpenAI says it has sent hundreds of reports and patches to kernel maintainers, with 304 critical findings disclosed so far, and is sending the rest in stages. The same model also found 81 new high-severity Firefox bugs. In practice, expect a large wave of kernel security fixes over the coming weeks.

GPT-6 Cyber, announced November 5, is limited to a small group of approved security customers. It is not a public model.

Sources: OpenAI’s kernel research post, the GPT-6 Cyber announcement, and SecurityWeek’s coverage.

I asked Web Dev to keep kernel updates and reboots on a regular schedule as these fixes land, rather than waiting for one big emergency patch.

On November 9, Anthropic released Fable 5.2, an upgrade to its top-end model for large technical work, plus Mythos 5.2 for vetted security and science groups.

Anthropic says Fable 5.2 is up to 30% faster than 5.1, and cheaper at $8 per million input tokens and $40 per million output tokens. There is also an optional fast mode at double the price. On Anthropic’s own published tests, it beats Opus 5.5, GPT-6 Astra, and Gemini 4 Carbon on most coding, computer-use, and reasoning measures. Those numbers come from the vendor and have not been checked independently.

Anthropic still recommends Opus 5.5 as the everyday model, and Fable for the hardest open-ended work. Fable 5.2 is available today in the Claude apps, the API, AWS, Google Cloud, and Azure. Mythos 5.2 requires an application to a verification program.

Source: Anthropic’s announcement.

No action needed on this one. It’s ready to use if you want a higher-end model; treat the benchmark claims as vendor numbers until independent tests appear.

On November 4, OpenAI released Images 2.6, its new image model, in ChatGPT, Codex, and the API.

The API comes in two versions: Flare for fast iteration, as little as about six seconds at low quality, and Sunburst for detailed work that needs to stay consistent across edits. OpenAI says it’s 50% faster than the previous version. New features include animated GIF output, SVG export, pointing to the exact spot to edit through the API, and a setting that controls how much planning the model does. It’s live now for all ChatGPT tiers.

Separately, OpenAI’s API reference says the older model known as gpt-image-1 was shut down on October 23.

Sources: OpenAI’s announcement, the API model docs, and the API reference.

No action unless a site or script still calls that older image API. In that case, the call would already be broken.

According to Ars Technica, Elon Musk announced on X on the evening of November 5 that Tesla will stop building the Cybertruck around mid-2027. TechCrunch covered it on November 6. Tesla plans to use the space at the Texas factory for more Cybercab robotaxis. TechCrunch reports Tesla says Dallas is next for Cybercab, later this month. Tesla already ended Model S and Model X production earlier this year.

On Full Self-Driving, the current Hardware 4 build is still version 14.3.13. The November 4 software build, 2026.38.5.12, has the same release notes as the October 20 build. According to the tracker, version 14.3.13’s notes also match 14.3.12, so FSD itself has not changed meaningfully. The notes list pothole avoidance and wider use of reasoning as upcoming, but not shipped. Those FSD details come from Not a Tesla App and the FSDUpdate tracker, not from Tesla’s own site.

Sources: TechCrunch, Ars Technica, FSD release notes on Not a Tesla App, and the FSDUpdate tracker.

No action on this one. It’s a production plan, not a change to cars already on the road. FSD was quiet this week.