Anthropic security research reportedly found CVE-2026-98432, a network-reachable use-after-free flaw in the Linux kernel's IPv4 TCP handshake handling. The report says an unpublished internal Claude model discovered the issue and generated a two-stage exploit that bypassed kernel address randomization and executed commands with Root privileges, although the exploit code was not released. Upstream fixes are available, but the cited report says several Ubuntu releases remained affected as of November 1.

36氪 reports that CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, allow unauthenticated attackers to execute arbitrary programs on PHP-backed servers through crafted HTTP requests. It says AI-assisted scanning played a role in finding the flaws, while citing claims from the PHP Foundation and OpenAI and Wiz.

A Reddit investigator reports that the tested weights in the burner22/numbat checkpoint were deterministically generated rather than learned through training. The investigator says SHA-256 and NumPy PCG64 reconstructed all 633 tested tensors, covering 11,374,080 values, bit for bit. All 373.6 million weight signs matched predicted pseudorandom sequences, and 99.51% of 173 million held-out NVFP4 quantization codes were reconstructed. A 4.73B-parameter truncated model ran but produced repetitive punctuation rather than meaningful language. Some semantic structure was found in the embeddings, which the investigator says does not make the reconstructed weight families genuine trained weights. The analysis does not identify who created the checkpoint or establish whether it has any connection to Anthropic.

The AiSOC project README describes an MIT-licensed, self-hostable security operations platform that normalizes telemetry, runs the 2538 executable rules of its 7023-rule library, groups hits into incidents, investigates them with AI agents whose prompts and tool calls are recorded, and proposes actions for human approval. Its smallest "core" deployment runs with no API keys and ships a local Ollama-served llama3.2:3b model plus the CISA KEV threat feed, while an MCP server supports Claude, Cursor and Continue. The README states AiSOC is not a drop-in SIEM replacement, cannot see telemetry that has not been connected, and is not autonomous by default; it also notes that demo incidents are synthetic and published benchmark numbers are substrate self-consistency measures rather than live agent accuracy. Deployment requires Docker Compose v2 with about 8 GB of memory and 20 GB of free disk in the Docker VM. The project says development is funded and supported by Cyble, which releases it under the MIT licence with no gated modules or telemetry.

Serena v2 has been released with a new REPL-based agent interface, according to the project documentation. The MCP toolkit provides coding agents with symbol-level code retrieval, editing, refactoring and debugging through language servers or the paid Serena JetBrains Plugin.

奇点研究社 used Kling 4.0 to create an exhibition tour video with live-action footage, AI presenters and seven generated segments, supported by roughly 3,000 Chinese characters of prompts. Some shots achieved professional quality, but the test also exposed incorrect subject placement, broken long takes, unstable edits, voice mismatches and garbled audio. The results indicate that Kling 4.0 can produce usable shots while still requiring manual intervention for dependable end-to-end delivery.

cnBeta reports that Andrej Karpathy released HackerTube, a weekend project that uses recommendations found in two decades of Hacker News comments to assemble a video library. Karpathy says Claude Code, running Claude Opus 5.5 with medium reasoning effort, analyzed 43 million comments, selected 6,454 repeatedly recommended videos, and assisted with development and deployment. He also says the project took about two hours, while HackerTube requires no account and stores usage state in the local browser session.

Alibaba Cloud upgraded its Memory service for Personal Agent scenarios, improving the recall of user preferences, plans and historical commitments. The service extracts information from conversations, stores it as memories and user profiles, and retrieves relevant records for later responses. Developers can customize memory rules and profile fields, manage and trace records in the console, and use the API for writing, viewing and semantic retrieval. Memory can also be connected through MCP and CLI to tools and frameworks including Codex, DeepSeek Harness, Claude Code and OpenClaw. The report says Memory achieved the highest scores in four HaluMem-medium measures and ranked first among eight systems in PersonaMem-v2 with an overall score of 56.82.

Turkey’s Competition Authority has opened an investigation into Google Search's “AI Overviews” and “AI Mode” to assess whether they violate the country’s competition law. According to IT之家 AI, the review covers traffic effects on publishers and other creators, content-licensing terms, exclusivity involving publishers and AI chatbots, and possible differential treatment in selecting or licensing content. The regulator also says it will impose interim measures governing Google’s use of publisher content in AI-powered search.

The Next Web reported that ADNOC signed a multi-year agreement with OpenAI and G42 to deploy AI agents across its oil and gas operations using G42-provided computing infrastructure in the UAE. The first application will focus on field-development planning, with plans to extend to refining, trading, cybersecurity and employee training; ADNOC claims the system could produce a complete development plan in hours instead of months, while human experts will retain oversight of major decisions. The contract value and rollout schedule were not disclosed, and the claim that ADNOC will be the first energy company to use OpenAI Frontier was not independently confirmed.

A Starship Technologies delivery robot reportedly ran a red light in Tallinn, Estonia, on October 26, causing a bus to brake sharply and collide with the robot, injuring nine passengers. Bus cameras recorded the collision. COO Pepe Aaviksoo attributed the incident to dim lighting, a bright billboard, an ambiguous signal layout and a malfunctioning light sensor, while disputing the initial report that the robot left before police arrived.

A 36Kr report based on interviews with doctors documents clinicians using Doubao to check drug interactions and patients bringing AI-generated medical concerns into consultations. Hospital verification corrected the claim that a patient in Xuzhou refused a prescription: the doctor had found a new drug unsuitable and issued no new prescription that day. The interviews emphasize that AI may assist with information gathering, while diagnosis, prescriptions and clinical responsibility remain with physicians.

A Chinese-language report published by 36Kr says theoretical neuroscientist David Clark used GPT-6 Astra to work on the complete Lyapunov spectrum of the Sompolinsky 1988 model. The report says GPT-6 ran independently for about 100 minutes before producing an initial derivation, whose solution it says matched supercomputer simulations. Claude Opus 5.5 then assisted Clark and the AI models in analyzing and reformulating the derivation into a human-readable result. The report says the final work reproduced the original Schrödinger-equation result and links to an arXiv paper.

Scenario Labs published the scenario-labs/skills repository, giving AI coding agents workflows for creating images, video, audio, textures, skyboxes, 3D assets, and custom-trained models through the Scenario MCP server. According to the vendor, the open Agent Skills-format tools can select models, estimate prices, and preserve character and brand consistency; separate expert teams also drive locally installed software such as ZBrush, Blender, Maya, Unreal Engine, Unity, Godot, and Roblox Studio.

Scrapling is a Python web-scraping framework that combines HTTP requests, stealth browsers, parsing and concurrent crawling in one library. Its project documentation says it can render JavaScript, interact with websites and capture API calls, with features including spiders, proxy rotation, a CLI, an MCP server and an Agent Skill for AI agents. These capability and performance descriptions come from the project and have not been independently verified.

Hex is a voice-dictation application for Mac, Windows and Linux that lets users hold a key, speak, and paste transcribed text into the active app. Its README says transcription runs on the device after a speech model is downloaded on first launch. Stable and Dev builds are available for multiple desktop architectures, with additional installation options through Homebrew, AUR, a Linux script, and Nix.

Handy is described as a free, open-source, extensible cross-platform desktop application for speech-to-text. It lets users press a configurable keyboard shortcut to record, processes speech locally with Whisper or Parakeet V3, uses Silero for voice activity detection, and pastes the transcription into any text field. The project says the workflow works without sending audio to the cloud and supports Windows, macOS, and Linux.

According to cnBeta’s report on research published in Nature Communications, University of Würzburg researchers developed an oxide-interface device that can switch among transistor, memristor and memcapacitor modes. Built from lanthanum aluminum oxide and strontium titanate, the device supported a reservoir-computing circuit that recognized digits from 5×4 black-and-white images. In the reported test configuration, the device-based circuit consumed about 2.71 nJ per input pulse, compared with about 16.57 nJ for a transistor-and-memristor control circuit.