Small Web Business

Anyone who patched a self-managed GitLab server last week has to do it again. GitLab put out another critical release on Wednesday for CVE-2026-110264, a remote code execution flaw rated 10.0 on the CVSS scale that an attacker can reach without logging in. The fixed builds are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13,

On the same day Axios reported that large U.S. banks are finding unauthorized AI agents inside customer accounts, 1Password began rolling out a way for those agents to log in without ever holding a password. The product, 1Password for Agents, is included at no extra cost for Individual and Family accounts on 1Password.com, the company

Anthropic is giving Agent Skills, the SKILL.md format it built to teach AI agents specific jobs, to the Agentic AI Foundation, the Linux Foundation group that already looks after the Model Context Protocol. More than 70 agent platforms have integrated the standard so far, ChatGPT, Cursor, GitHub Copilot and VS Code among them, the company

YouTubers Tim Pan and Joanna Stern put the iPhone Duo through its paces, torture testing the folding screen and hinge to see if it will hold up over the long haul. The iPhone Duo is Apple’s first entry into the foldable space and represents one of the biggest risks the company has taken in years

Frontier model builders that rent GPUs from clouds and neoclouds have to run their model weights on hardware they don’t control. NVIDIA is pitching a fix for that with Confidential Bare Metal, a deployment option it says lets model builders run sensitive workloads on third-party infrastructure “while retaining control of their models and data.” NVIDIA

Security teams that pipe GitHub audit logs into a SIEM have until Nov. 12 to check their filters. On that date, the business field in secret_scanning_alert.* and secret_scanning_push_protection.bypass events will switch from the enterprise display name to the enterprise slug, GitHub said in a changelog update. Integrations that match on the display name will stop

Coding agents and CI runners install dependencies all day without a person watching, and that makes them an easy target for poisoned packages. GitHub’s answer is a package firewall that sits between those machines and the public npm registry, now in public preview for GitHub Enterprise Cloud customers. The firewall inspects both metadata requests and

The Tech Stack Behind a Smarter Ambulatory Surgery Center A surgery center can adopt digital scheduling, electronic records, and cloud reporting yet still spend hours reconciling spreadsheets and chasing updates. Systems supporting clinical care, daily operations, and the business office do not always exchange information in ways people can act on. For ambulatory surgery centers

Attackers were already probing for the PHP flaw known as PHP2Shell four days before it was supposed to become public, Amazon’s threat intelligence team said in a security blog post Wednesday evening. The team found an exploitation attempt in telemetry from MadPot, Amazon’s network of honeypot sensors, dated Saturday, Oct. 17. The request came from

Linux kernel developers will no longer need to disclose the use of AI in development, a major change for the biggest open source project in the world. AI has become an increasingly divisive topic in the open source community, with various projects and Linux distributions taking different approaches. Some have opted to allow AI contributions,