CISA has added one vulnerability to its Known Exploited Vulnerabilities Catalog, CVE-2026-114625, an SQL injection flaw in Arista VeloCloud Orchestrator, on evidence of active exploitation. Federal civilian agencies are directed to prioritise remediation on publicly exposed assets under Binding Operational Directive 26-04, and CISA urges all organisations to do the same. In a week of PHP2Shell and GitLab patching races, the catalog keeps growing by single, exploited entries.
Agent cloud startup Daytona has raised a $60 million Series B at a $1 billion valuation, led by FirstMark Growth, taking its total raised to $91 million. The New York company builds cloud infrastructure for long running agents, giving each agent sandboxed Linux, Windows, macOS and GPU environments, and the round drew angels including Patrick Collison, Tobi Lutke, Aravind Srinivas and Eric Yuan, with Qualcomm Ventures, Samsung Next and Okta Ventures participating.
Nirva has raised a $25 million pre Series A round, bringing its total to $33 million including $8 million raised earlier this year from investors including Lightspeed and South Park Commons. The startup, founded in 2025 by former Meta Reality Labs staff, makes an eight gram pendant that listens only to its wearer’s voice, using a voice profile built at setup to filter out nearby speakers. Pre orders open in November at $249, with shipments to early users expected by year end.
Japan will simulate cyberattacks with AI in response to the PHP flaws, according to reports carried by Investing.com and Tech in Asia, a government level escalation of the PHP2Shell response that began with website shutdowns across Europe and Asia earlier this week. Separately, the forum user whose accidental early post broke the PHP news embargo and sparked worldwide panic has come forward, according to Tom’s Hardware, closing the human loop on how the disclosure went wrong.
Intel has received a waiver after concerns that a broad US ban on foreign made robots could hit its fabs, Ars Technica reported, a reminder that industrial policy written for one supply chain routinely snags another. Google has updated its privacy policy in terms that Ars Technica reads as allowing Gmail content to be used for advertising, a change with obvious revenue and regulatory implications if it holds; both items are carried at headline length here pending fuller reporting.
A gigawatt scale data center has been proposed for a former steel mill site in Illinois, Datacenter Dynamics reported, continuing the pattern of AI capacity landing on heavy industrial land with power infrastructure already in place. Switzerland’s federal government has published an $8.5 billion tender for cloud services, one of the largest sovereign cloud procurements yet disclosed. And in Portugal, a data center outage left the National Health Service without prescription services, Datacenter Dynamics reported, the week’s clearest case of data center reliability as public infrastructure risk.
Meta has detailed its Ohio Prometheus campus with the first phase live, Datacenter Dynamics reported; the engineering and GPU redundancy detail of that cluster was covered on this site on October 21 and is not repeated here. Quest Diagnostics has confirmed that patients’ personal and health data was compromised in a breach, TechCrunch reported; the health data detail belongs to the life sciences beat and is noted here for its security dimension.