Kategorie

A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]

A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]

Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. [...]

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]

Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]

Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off." Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. [...]

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12. Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti, Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain, Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. [...]

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]

When Workday acquired Sana just about a year ago, it said that the combination of Sana’s AI with Workday’s platform would create a new “front door” to work. Today at its Workday Rising conference, it unveiled that front door, turning Sana into Workday’s default home screen that, it said, “brings tasks, decisions, meetings, and agent activity into one place, helping employees move directly from what needs attention to getting it done.”

The new interface goes beyond merely answering questions to orchestrating Workday’s agents to execute tasks. Each employee’s experience is tailored to their role; when they open the application, they see the tasks and decisions that need their attention and can take action directly from the UI. And, using TypeSafe’s Jev AI model, Sana adapts its UI to each task, the company said, generating forms, calendars, approval cards, visualizations, and other interactive experiences in real time and completing tasks once the employee approves the action. It also supports work that spans multiple days, displaying relevant information at every stage of functions such as financial closing or preparation of workforce plans by HR.

Sana also works within other AI tools and platforms including Anthropic Claude, Google Cloud’s Gemini Enterprise, and Microsoft Copilot, as well as within Microsoft Teams and Slack. But, Workday said in its announcement, “third-party AI tools and platforms never get raw access to Workday data — they can now access this data through Sana, and Sana does the reasoning, applies each company’s own permissions, approvals, and policies, and carries out the work so actions are lawful by design and recorded, regardless of the tool it started in.”

Along with the Sana home page, known as Workday Home, the company introduced Sana Concierge, which brings together the self-service capabilities and Sana for IT Service Management released earlier this year with Workday Help and Case Agent to create AI-native employee services spanning HR and IT. Workday said it can resolve requests such as password resets, access requests, and questions about time off and payroll, as well as performing onboarding and offboarding. The employee just submits a natural language request, and Concierge looks up relevant policies and, based on the employee’s Workday information, guides them through the steps to complete their request.

If a human decision is needed, Concierge routes the request to the right person in the background, but remains the employee’s point of contact.

The Sana Workday Home experience is available today, with more capabilities and support “coming soon,” the company said. Sana Concierge is available now to early adopter customers, with general availability expected in the first quarter of 2027.

From copilots to autopilots

The company also introduced four new autonomous AI agents that act as autopilots across hiring, payroll, accounting, and compliance.

“From co-pilots to autopilots, that’s a big transition that you will see across our agents today,” said Joel Hellermark, former CEO of Sana, who is now Workday’s chief AI officer. “These are now agents that anticipate what needs attention, they apply the company’s policies, they advise on the next step, and then act once the appropriate person approves that. And these autopilots run completely on Workday’s rails, so they’re self-governed and compliant.”

And, he said, while a typical copilot-driven system “sits there” until the user logs in, autopilot agents run on a heartbeat, operating whether or not the user is online.

The Talent Acquisition Agent, for example, monitors the open job queue from the time a position is posted, finding qualified candidates and giving the recruiter information about them. It can generate outreach to potential hires and present it to the recruiter for approval, explain why candidates on a short list are a good fit, and schedule interviews with those the recruiter flags. It then automatically joins the interview and takes notes. Based on recruiter feedback, the agent learns how to improve its recommendations.

The agent works across multiple recruiting tools, including Workday Recruiting, HiredScore, Paradox, native Workday skills, and connected sourcing providers. The autopilot capabilities are available to early adopter customers today, with general availability planned for early 2027.

Three more autopilots will arrive for early adopters in early 2027, for Payroll Agent, Accounting Agent, and Deployment Agent.

This could be the start of a change in the coordination of work, said Melody Brue, analyst in residence at Moor Insights & Strategy. “Workday is trying to connect more of the work around a decision, from weighing options to carrying out the approved plan,” she said. “Sana could become the starting point for that process, giving Workday a larger role in coordinating work beyond its own applications. For current customers, the meaningful change would be less manual coordination between a request, an approval, and a completed transaction. The value depends on whether that reduces the work employees have to manage or shifts it into resolving exceptions when a workflow crosses systems.”

Extending Decision Intelligence

Workday Decision Intelligence, first seen in Adaptive from Workday, is spreading into more areas of the business, said Yasmeen Ahmad, SVP and GM, Workday Data Cloud.

Decision Intelligence is not an agent performing a task, she said. “It’s a planning and reasoning experience built for decisions that are too complex, too high stakes, or too cross-functional for any single task to capture.”

Ahmad described a scenario in which HR revised a hiring plan using Decision Intelligence, passing it to Finance to use as an input for reviewing its quarterly projections with the same tool.

“Normally this would have taken six weeks, five spreadsheets, and analysts trying to stitch it together. Today, it was all just a prompt,” she said.

Brue said that what she finds interesting is whether Workday can take more of the manual modeling out of a staffing discussion. “Workday already supports connected workforce and financial planning,” she said. “If teams can work through several options with fewer model adjustments and less reliance on specialists for routine ones, planning could be more responsive when business needs change.”

Work Intelligence

Work Intelligence, available to early access Workday Human Capital Management customers, breaks jobs into their component tasks, describing the skills employees need to perform them. It draws on Workday Skills Cloud, giving leaders a look at how jobs are changing, and then, using Decision Intelligence, companies can get a picture of their internal readiness for evolving work.

“The task-level analysis is worth watching,” Brue said. “A role is rarely entirely automatable or entirely human-led. Looking inside the role could give customers a more useful basis for redesigning work. But saving time across a dozen tasks doesn’t automatically free someone up for a different assignment. Companies may need to regroup the work, letting agents handle routine steps together and giving employees clear responsibility for what comes next.”

Off with its head

Workday also announced that its Trusted Agent Platform, on which organizations build and run AI agents governed by their business rules, is now headless, allowing customers to use the development tools and models of their choice. It brings together the existing Workday Data Cloud, Agent-Ready Tools, Developer Agent, custom agents, and Agent Harness.

However, Workday CTO Gabe Monroy emphasized that, at the same time, “headless can’t mean lawless. The rules for HR and finance already live in Workday, so customers don’t have to rebuild them for every agent they create. This is what lets companies move fast with agents without losing control.”

And, to enhance the controls, in early 2027 the company will add Agent Context Service and Grounded Reasoning to Agent Harness to provide Workday context that agents need and check requests against company policies, business processes, and tenant data before the agent is allowed to act.

“Governance gets more consequential as agents move from recommendations to actions,” Brue pointed out. “An agent can be authorized and still make the wrong call. Customers need to distinguish permission to recommend from permission to execute. And know which actions require human approval, especially in hiring and finance. The governance question extends to any workflow that crosses platforms. Customers need clear ownership of approvals, exceptions, and the audit trail when a request starts in one system, and an agent acts in another.”

For companies already using Workday and ServiceNow together, she said, there’s an additional consideration: Workday’s expansion into employee-facing AI and agent governance could create more overlap between platforms that have traditionally played complementary roles.

“Joint customers don’t suddenly need to choose one, but they may need to clarify which platform coordinates the work and how controls operate across both,” she said. “A unified experience won’t necessarily mean unified control.”

This article first appeared on CIO.

Apple has launched its most serious push yet into your home, built around its attempt to normalize always-on AI with Siri. As widely expected, the new products include its much-anticipated Apple HomeView smart display, a new Apple TV 4K with Siri AI, the next generation HomePod mini 2, and Apple Home Collection, a range of home accessories designed in collaboration with third-party partners.

What is HomeView? 

HomeView is a central control and entertainment device for smart homes. Powered by Apple Intelligence with Siri AI, the wall- or stand-mounted smart display costs $299 and has an A18 chip that runs “HomeView” software.

Apple confirmed most of the pre-event speculation, most particularly that the product will not be available in the European Union, as Siri AI is currently unavailable there due to restrictions within the Digital Markets Act. Apple did say it is “working constructively with the EU in an attempt to find a path forward.” We’ll see how that turns out.

Features include a custom-engineered acoustic system, FaceTime, face recognition, and Apple’s promise on privacy (which is that it provides you with some). The device supports up to six users; it uses face recognition to identify a user and then adapts what they see so they can access their own personal content on the device. That means you’ll see your emails, while your partner will see their own, for example.

HomeView is also a new breed of contextually driven AI devices, so it can call on your personal context to answer questions or requests. Wired called it a “giant Apple Watch for the home.” Industry watchers think it looks like a mini iMac G4, with a rounded base and a display on a stalk.

same same. pic.twitter.com/etlyfk8bBf

— Basic Apple Guy (@BasicAppleGuy) October 13, 2026

It has a 7-inch Liquid Retina display connected to a domed speaker base by a stainless steel hinge that provides a smooth tilt for comfortable viewing on tabletops of any height. It is available in silver, starlight, rose pink, and space gray. It has a built-in speaker reportedly capable of making a great sound, is AirPlay compatible, and works with compatible home security cameras to become an AI-powered home security system.  

It’s thought that Apple originally hoped to introduce HomeView a year or so ago but was stymied by its failure to develop Siri AI to schedule. All the same, it’s an important product, as it shows the company experimenting with ways to provide ambient AI experiences that actually benefit consumers. It puts the company up against products in the ilk of Amazon’s Echo Show or Google’s Nest. It also echoes Samsung’s SmartThings ecosystem, but platform integration and privacy may give it the edge.

Apple Apple Home Collection partnerships

The Apple Home Collection is a rare excursion into partnership, with Apple working with both LG Electronics and Schneider Electric to introduce a new range of smart home accessories developed in collaboration. 

It’s unclear whether this is a new licensing system for smart home products, building on the Works with Apple Home accessory branding Apple has offered for a while. 

This is smart home tech done better, however, as the big selling point is that you can install these products easily, “starting with one tap with iPhone.” You don’t need to install other apps, create new accounts or otherwise create additional cruft. The products are also designed for privacy, with Home app data encrypted end-to-end, so LG Electronics, Schneider Electric, and Apple can’t read it. They support the Matter and Thread home networking standards.

“Apple Home Collection makes it easy to choose smart home accessories with confidence,” said Matthew Costello, Apple’s vice president of hardware engineering.

The new gadgets are available in a limited number of nations — mostly the US, UK, and Canada, though some are North America only. As anticipated, the new products include:

• A video doorbell
• Floodlight, outdoor, and indoor cams that are iCloud+ compatible
• Smart deadlock
• Smart thermostats

Apple reached a deal with ADT to offer professional installation of these accessories for a fee, though you don’t need to do this.

Prices seem to hover around the $200 mark. The LG Video Doorbell Wired starts at $250 (US), while the Schneider Home Smart Thermostat starts at $200 (US), for example.

New Apple TV 4K and HomePod mini

The HomePod mini 2 smart speaker is available in five colors and brings support for Siri AI (where available). It uses a new S10 chip to analyze music in real time to optimize dynamic range, loudness, and acoustic performance. A new feature called Sound Glow “dances” to the music, glowing and pulsing color inspired by the album cover. It works as a smart home controller and costs $149.

If you’re feeling flush, you can invest in four of these to create a quadrophonic speaker system for use with the new Apple TV 4K.

The upgraded Apple TV 4K has a new A19 processor, while built-in far-field microphones bring support for Siri AI where it is available. You can link it to the HomePod mini for better sound. The device works as a home hub and can also access your home video surveillance feeds. The processor upgrade means you’ll get smoother navigation and faster response. The system, which costs $299, also has a new, dedicated AV1 decoder, which should enable more efficient, high-quality streaming while using less bandwidth.

An interesting note: Siri AI will be available as a beta on older Apple TV 4K models (second generation or later) in most English-speaking countries. 

For the rest of us?

It seems relevant to mention a few yet-to-be-determined questions and rumors, such as what support the new Apple home ecosystem will provide for non-Apple devices. For example, if you are the only person in your family using an Android phone, you are locked out of the family experience of this smart home integration. How can that user use the product? When it comes to privacy, does the new Apple TV use Automatic Content Recognition to any extent, and how much viewer information does it collect? One more thing that has been picked up is that Siri AI will be available as a beta on older Apple TV 4K models (second generation or later) in most English-speaking countries. 

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. [...]

New market research from Counterpoint Research shows that global smartphone sales fell by 20% in the third quarter of this year compared with the same period a year ago. This is the lowest level for a third quarter since 2012.

The decline is attributed to the ongoing shortage of memory components, where sharply rising prices for DRAM and NAND memory have driven up manufacturing costs. Manufacturers, in turn, have raised prices for customers. According to Counterpoint, global smartphone prices have risen by about 20% in 2026.

In terms of market share, Samsung continues to hold the top spot with 23%. Apple is close behind with 22% of the market, the highest share the company has ever held in a third quarter.

Counterpoint does not expect to see any clear recovery in the mobile market for the remainder of the year.