Actively exploited Ivanti VPN flaw allows unauthenticated commands
Ivanti disclosed CVE-2026-104935, an authentication-bypass vulnerability in Connect Secure that can let a remote unauthenticated attacker run arbitrary commands. The flaw has a CVSS score of 8.6 and is being exploited in the wild; Ivanti has released fixed versions for the affected branches.
Why it matters to you
A compromised VPN appliance can expose credentials and provide a trusted path into internal networks. Patch immediately, run Ivanti's Integrity Checker Tool, preserve external logs, rotate secrets stored on the appliance and investigate lateral movement; rebuild from a trusted image if integrity checks indicate compromise.
Windows update fixes an exploited Mark-of-the-Web bypass
Microsoft's October security release addresses 1,411 listed vulnerabilities, including 70 rated critical. CVE-2026-96951, a Windows Shell command-injection issue that can bypass Mark of the Web protections, was already being exploited when the update shipped.
Why it matters to you
Prioritize the exploited bypass across managed endpoints instead of treating every patch as equal. Validate the update in a pilot ring, accelerate broad deployment, confirm Defender and EDR health and review telemetry for suspicious archives, scripts and files delivered from the internet.
Gemini 4 Argon arrives with launch pricing that doubles after November
Google launched Gemini 4 Argon for multi-step work in coding, finance, law, cybersecurity and science. API pricing starts at $2 per million input tokens and $10 per million output tokens, then doubles after 30 November; Google's productivity claims still need testing on independent workloads.
Why it matters to you
Benchmark quality, latency and cost per completed task using your own SaaS workflows, and budget against the post-launch price rather than the introductory rate. Keep the model behind an abstraction layer and give agent tools short-lived, narrowly scoped credentials.
Scaleway chooses AMD and Sweden for a European AI supercomputer
Scaleway plans its first AI supercomputer outside France in Sweden, using AMD Instinct MI355X accelerators and the open-source ROCm software stack. The system will combine Bull and Giga Computing servers, HPE networking, VAST storage and liquid cooling, with Sweden selected partly for low-carbon power.
Why it matters to you
This creates another European route for AI capacity outside the dominant CUDA ecosystem. Test ROCm compatibility and migration effort, then measure the complete platform—including fabric, storage, cooling and data residency—rather than comparing accelerator specifications alone.
AI labs and evaluators still disagree over what safety findings can be published
Reuters reports that frontier-model developers and external safety evaluators are still negotiating how much control laboratories should have over publication, methods and trade-secret redactions. With no common standard, model providers retain significant leverage because they control access to unreleased systems.
Why it matters to you
Vendor-sponsored testing is not automatically independent evidence. For consequential SaaS features, require contracts that protect evaluator control of methods and conclusions, disclose redactions and conflicts, preserve access logs and make important findings reproducible before agents receive sensitive data or production permissions.