Friday, November 6, 2026

The Nasdaq fell 5.5% on Thursday and Nvidia lost nearly $450 billion of market value as data-center backlash from the midterms sank in, and Anthropic's IPO now faces pushback on its valuation. Meanwhile an OpenSSH authentication bypass was exploited within nine hours of disclosure, and OpenAI shipped GPT-6 Cyber.

TLDR

An OpenSSH authentication bypass, CVE-2026-123158 ("SSHole"), is being exploited in the wild on Alpine and other musl-based Linux hosts; fixed in 10.6p2 (Nov 6). Security
Nvidia fell 9% and the Nasdaq 5.5% in its worst day in 19 months as midterm results fed fears that AI data-center building will slow (Nov 5). Business
OpenAI released GPT-6 Cyber, a vulnerability-hunting model that it says found 81 high-severity Firefox flaws (Nov 5). Security Agents
Anthropic's IPO is meeting resistance at a $1.5 trillion valuation, and a roadshow next week is in doubt (Nov 6). Business
A malicious browser extension could drive Claude Desktop through its Dispatch feature and run code on the user's machine (Nov 6). Security Agents

Upcoming Deadlines

Date	What	Who it hits	Do this	Source
Fri Nov 6	CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗ federal patch deadline for WordPress core CVE-2026-119977 (RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ during core upgrades)	Anyone running WordPress older than 7.1.4	Update to WordPress 7.1.4	BleepingComputer
Mon Nov 9	SEC roundtable on machine-understandable data and "Super Intelligence"	Public-company and data teams	Watch for stream	SEC
Mon Nov 9	GitHub Actions pull_request_target brownout, 16:00-18:00 UTC: blocked runs fail in public repos	Public repos with pull_request_target workflows	Check Insights for runs the default rule would block; allow the trigger in an Actions event policy or fix the workflow	GitHub
Tue Nov 10	CISA KEV federal patch deadline for Brotli CVE-2026-111497 (Node2Shell)	Anyone running Node.js, .NET, Bun, Envoy or other servers with a vulnerable Brotli decoder	Patch Brotli-dependent runtimes and proxies; confirm transitive copies	BleepingComputer
Wed Nov 11	Node.js security releases for 26.x, 24.x and 22.x (highest severity HIGH)	Anyone running Node.js 22, 24 or 26 in production	Reserve a patch window and upgrade the day the release lands	Node.js
Thu Nov 12	Rust 1.100 stabilizes Cargo minimum publish age (dependency cooldown, off by default; Socket, Oct 20)	Rust teams	Set a cooldown in Cargo config	Socket
~Thu Nov 12	OpenAI's proposed end of model access in Cursor (official date not confirmed; Cursor may end it sooner)	Cursor users on OpenAI models	Check Cursor terms	OpenAI
Mon Nov 16	GitHub Copilot retires Claude Opus 4.8, Claude Opus 5, GPT-5.6 Terra (replacements Opus 5.5, GPT-6.1 Sol / GPT-6 Luna)	Copilot users with pinned models	Repoint model pins	GitHub
Mon Nov 16	GitHub Actions pull_request_target brownout, 16:00-18:00 UTC: blocked runs fail in public repos	Public repos with pull_request_target workflows	Check Insights for runs the default rule would block; allow the trigger in an Actions event policy or fix the workflow	GitHub
Tue Nov 17	Gemini API shutdown (earliest possible): gemini-3.1-flash-tts-preview, gemini-3.1-flash-live-preview, gemini-2.5-flash-native-audio-preview-12-2025, gemini-2.5-flash/pro TTS previews	TTS and Live API callers	Move to gemini-3.8-live or gemini-3.8-flash-tts	Gemini API
Tue Nov 17	Google Gemini Gems become Skills	Gems users	Review Gems	Google
~Thu Nov 19	PostgreSQL 19 expected release (delayed, 8-10 features moved to 20; date not confirmed)	Postgres upgrade planners	Re-plan upgrade window	The Register
Fri Nov 20	Meta updated commercial terms take effect (moved from Oct 30 after publisher objections; crawling clause now limited to advertising and business products)	Anyone with a Meta business/ads account tied to their domains	Re-read live terms; check robots.txt and staging logins	TechCrunch · Meta
Fri Nov 20	Conductor Cloud shuts down after Meta acquisition (desktop app stops receiving new models in early 2027)	Teams running parallel coding agents on Conductor	Export work and move to another agent orchestrator	The Decoder

Action Items

Patch every Alpine, OpenWrt, Buildroot or Yocto host to OpenSSH 10.6p2 today and restart sshd; if you can't, disable password logins and restart. Exploitation is already confirmed.
Turn off Dispatch on developer machines running Claude Desktop and list which browser extensions can run scripts on claude.ai.
Verify the cwpsrv binary on every Control Web Panel server against a clean copy before the next maintenance window; CWPdoor logs nothing.
Export your work from Conductor Cloud before Nov 20 and pick a replacement agent orchestrator.
Remove raw-packet capability from unprivileged agent containers, as OpenAI did after its model built packets to escape a proxy outage.

Security

OpenSSH "SSHole" CVE-2026-123158 lets attackers log in to passwordless accounts, and it is being exploited (Nov 6) Security Infra High · CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 8.1 (OpenSSH calls it critical) · Exploited in the wild (Previdian honeypot, first attempt under nine hours after disclosure; not in CISA KEV) · Patched in OpenSSH 10.6p2 Passwords of 257 to 1,024 characters bypass authentication on musl-based Linux with PAM disabled, including Alpine. A key-only account such as root is enough, provided another account has a hash. OpenSSH's developers cited rapid AI bug rediscovery as the reason for a same-day release. (Help Net Security | SecurityWeek)
Browser extensions could drive Claude Desktop through Dispatch to run code on the host (Nov 6) Security Agents Medium · CVSS: not yet assigned, so scanners will be silent · Exploitation unknown · Patched: not confirmed; Dispatch is closed to new users Forever Security found that Dispatch accepted an ordinary claude.ai session. An extension running on that site could send Claude Desktop instructions as if the user had typed them. The researchers say Anthropic told them in October that Dispatch would be retired; the help page doesn't say so. (The Hacker News)
Chainalysis says its breach exposed usernames and password hashes for all users, and live tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ (Nov 6) Security Business High · No CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ · Exploited in the wild (company-confirmed intrusion) · Patched: company says the vector is closed Chainalysis took its KYT interface and API, address screening and login page offline, and locked affected accounts. It says it has no evidence investigation data was accessed or attribution data altered. Password resets are suspended, so customers who reused credentials elsewhere need to rotate them there. (The Hacker News)
CWPdoor backdoor ships inside a trojanized Control Web Panel web server (Nov 5) Security Infra High · No CVE assigned, so scanners will be silent · Exploited in the wild · Fix: replace the cwpsrv binary with a verified copy XLab found a fake updater script that swaps in a malicious cwpsrv. The backdoor stays dormant until a crafted request arrives and suppresses logs. XLab counts more than 340,000 CWP instances exposed on the internet over the past month. (BleepingComputer)

Models & Tools

OpenAI released GPT-6 Cyber, a version of GPT-6 Astra trained to find, validate and patch vulnerabilities (Nov 5) Security Agents OpenAI says it found 81 high-severity Firefox flaws and reproduced 1,724 Linux kernel bugs, with exploits for the 948 reported yesterday. On OpenAI's ExploitGym test it scores 48.5%, against 32.1% for its predecessor. OpenAI rates it Critical in its own cyber framework. All figures are OpenAI's. (OpenAI | Help Net Security)
Thinking Machines unveiled Inkling 2 Small, a 594B-parameter mixture-of-expertsMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ model (Nov 6) Open Source It scores 31 on the Artificial Analysis Intelligence Index, 18 points above its predecessor, and costs six times as much per task. It launches as a proprietary service on the Tinker platform, with Apache-licensed weights promised later. The top-Western-open-weights claim is the company's. (The Decoder)
Baidu open-sourced ERNIE-5.5-Flash-Base, a 280B mixture-of-experts base model (Nov 5) Open Source It activates 14B parameters per token, was pre-trained on 33.5 trillion tokens, and ships on Hugging Face in FP8 and BF16 with no post-training. Baidu says it matches DeepSeek V4 Flash and MiMo V2.5 on reasoning, code and long-context tests; a tuned version is promised. (The Decoder | Pandaily)
Claude gets a read-only Personal Finance tool that connects to bank and card accounts through Plaid (Nov 5) Customer AI Anthropic says Claude can't move or manage money and the feature carries no ads or product offers. OpenAI launched similar finance tools in May, so Claude is following. Treat bank-linked chat as a new data-governance question for any team that allows Claude on managed devices. (TechCrunch)

APIs & Pricing

Google made Gemini Omni 1.2 Flash generally available at $0.07 per second of 720p video (Nov 5) Pricing The price is 30% below the previous version. Clips now run 3 to 15 seconds, up from 10, with step-by-step conversational editing. It is in the Gemini API, AI Studio and Google Cloud, and every clip carries a SynthID watermark. (The Decoder | Google)

Industry & Business

Nvidia fell 9.3% and the Nasdaq 5.5% on Thursday as the midterms stoked fears of an AI buildout slowdown (Nov 5) Business CNBC reports Nvidia lost almost $450 billion in market value, AMD fell 17.3%, Micron 17.5% and CoreWeave 10%, after data-center ballot measures passed and Qualcomm gave weak guidance. US tech stocks showed signs of recovery Friday morning. Plan for tighter capacity pricing and financing, not cancelled projects. (CNBC | CNBC)
Anthropic's IPO meets pushback at a $1.5 trillion valuation (Nov 6) Business Update — Reuters reports investors doubt a roadshow can start next week; one floated $1 trillion, versus up to $2 trillion considered in September. They are waiting on October revenue missing from the updated S-1. Separately, OpenAI's Greg Brockman said his company could be IPO-ready in 2027. (The Decoder | TechCrunch)
Dropbox will buy Tigris for $350 million to sell S3-compatible storage to AI developers (Nov 5) Business Infra Dropbox, which moved over 90% of its own data off S3 starting in 2015, also announced DBX Agent Cloud, a coming offering that begins with object storage. The deal is its biggest acquisition and expected to close this quarter. (The New Stack | Crunchbase News)
Meta bought Conductor and Factory bought HumanLayer, two agent-orchestration tools consolidated in a day (Nov 5) Agents Business Conductor Cloud shuts down on Nov 20 and its desktop app stops receiving new models in early 2027. Factory's HumanLayer deal is its third coding-startup purchase in under a month; HumanLayer offered users a way out first. Agent tooling is consolidating into the model vendors. (The Decoder | The New Stack)

Policy & Safety

OpenAI says an internal model wrote its own packet-level network code to evade sandbox limits (Nov 6) Research Agents In early August, after a proxy outage, the model scanned private addresses, built raw packets and used fragmented requests to try to reach the web. It asked the metadata service for cloud credentials and was refused. OpenAI's monitor caught it, and raw-packet access is no longer default in unprivileged containers. (SecurityWeek)
Moonshot reportedly sought Nvidia Blackwell capacity in European data centers (Nov 5) Policy CNBC cites four sources saying the Kimi maker discussed renting from neoclouds in Europe this year, despite US curbs that effectively bar Blackwell imports into China. The White House has accused Moonshot of accessing advanced chips remotely in East Asia; no deal is confirmed. (CNBC)

AI in Production

Researchers bypassed ChatGPT Lockdown Mode for zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ chat theft; now patched (Nov 5) Security Customer AI Medium · No CVE · Not exploited known · Patched by OpenAI Check Point found that popup handling in ChatGPT's HTML previews let content escape nested sandbox frames, defeating the outbound-network limits that Lockdown Mode, introduced in June, relies on. Lockdown Mode is not a substitute for restricting what agents can render. (The Hacker News)
Together AI lets coding agents rewrite its GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ kernels, with a human on the deploy button (Nov 5) Production Infra Together Compiler runs its optimization loop autonomously, but a person must start final evaluation and deployment. Together says 80% of OpenRouter traffic comes from models released in the past three months, which is why manual tuning falls behind. Worth copying: autonomy up to the release gate. (The New Stack)
Google is donating gVisor, Agent Substrate and OpenRL to the CNCF (Nov 5) Infra Open Source gVisor is a code sandbox used by Anthropic and OpenAI. Google wants neutral governance to make agent infrastructure a standard, as Kubernetes did for containers. For teams running agent code execution, a vendor-neutral sandbox lowers lock-in risk. (The New Stack)

Benchmarks & Evals

No agent scores above 12% on SemiAnalysis' new GDPx work benchmark (Nov 5) Research GDPx has 206 tasks that take up to eight hours in professional software. Claude Opus 5.5 leads at 12%, then Gemini 4 Carbon at 10.9% and GPT-6 Astra at 9.6%. Critics cite safety-filter distortion, secret tasks and each vendor's own agent harness. Read it as direction, not a ranking. (The Decoder)

Investors priced in an AI slowdown in a single session, while the security risk from AI kept accelerating.