Skip to content
TrustList

TrustList daily digest

Friday, 9 October 2026

Everything TrustList published on this day, 27 stories, grouped by subject and each in a line of our own.

News14

This group on its own

  1. 1News

    India's GST Council proposes automatic refunds and an end to tax arrests

    No rate changes at the 57th meeting. Engineering and R&D exporters get a fix for services done on customers' goods, and small consumer-facing businesses an optional annual return.

  2. 2News

    Windows devices must carry new Update certificates before 2027

    Two sets of Windows Update certificates lapse in 2027, and machines on Windows Server 2016 and 2019 have the earlier deadline. Devices managed through WSUS are not affected.

  3. 3News

    Anthropic's new usage policy applies from 12 November 2026

    Adds a human-stop rule for Claude-driven equipment, a ban on consentless tracking and fake-account campaigns, and spells out how the supported-regions limit reaches company-owned entities.

  4. 4News

    Automation Anywhere agrees to buy Boost.ai from Nordic Capital

    Boost.ai says it serves hundreds of customers, mostly European banks, telecoms and insurers. The deal needs regulatory approval and is expected to close in the fourth quarter of 2026.

  5. 5HR News

    DHS proposes a $70,000 school fee for each student's first OPT

    Later OPT recommendations, including STEM extensions, would cost schools $30,000 each. DHS says schools may pass the cost to students or employers, and the proposal is not yet in force.

  6. 6News

    Behavox buys Apiax to add cross-border compliance rules

    Apiax, founded in 2017, covers more than 200 jurisdictions; the deal closed with terms undisclosed and existing customers keep their product and support.

  7. 7News

    Deno joins Cloudflare: Deno Deploy shuts down in six months

    The open-source runtime gets a year of monthly fixes before development stops; JSR keeps running on Cloudflare and paying Deploy customers are offered migration help to Workers.

  8. 8News

    Swiss government backs AI automation for the federal administration

    A report on over 130 federal processes names five projects to push first. Every department and the Federal Chancellery must take on at least three use cases, but money is tight.

  9. 9News

    Spain sets rules for its public e-invoicing platform, SPFE

    Using the tax agency's platform is optional, but any invoicing software outside it must send a UBL copy of each invoice. Deadlines for businesses run from 6 October 2027.

  10. 10News

    North Carolina opens $2 million in grants for tech small businesses

    Money is split between a $210,000 pot for federal SBIR and STTR applicants and $1.92 million of matching grants; applications run to 30 June 2027 or until the funds are gone.

  11. 11News

    ATO to keep taking credit cards until 30 June 2027

    The tax office had said it would stop accepting cards after 30 November because of the surcharge ban. The government will fund it until June 2027, with the cost settled in MYEFO.

  12. 12News

    Siigo buys Chile's Bsale and pledges $100m for Latin America

    Bsale, founded in 2006 and active in Chile, Peru and Mexico, follows Siigo's 2025 purchase of Kame. Siigo is backed by Accel-KKR; the price was not disclosed.

  13. 13HR News

    ACLU asks California to investigate Criteria's Emotify hiring test

    The complaint also names Criteria's cognitive, personality and AI video interview tools, and arrives while Workday still faces a California discrimination case over its screening software.

  14. 14HR News

    EEOC moves to withdraw its 2012 guidance on arrest and conviction records

    The rule went to the White House for review on 6 October, and employment lawyers say employers still face Title VII risk if a background policy hits one group harder.

Tech and security7

This group on its own

  1. 1Security advisories

    Citrix fixes CVSS 9.5 NetScaler SAML flaw; no attacks seen so far

    Only appliances configured as a SAML service provider or identity provider are exposed; Citrix knows of no exploitation yet, and Shadowserver counts about 21,000 NetScaler fingerprints online.

  2. 2Security advisories

    Veeam fixes critical remote code flaw in Backup & Replication 12

    Version 13 is not affected, and Veeam lists no workaround. Singapore's cyber agency repeated the warning on 9 October, and version 12 reaches end of support on 28 February 2027.

  3. 3Security advisories

    Fortinet ships FortiMail fixes for exploited flaw CVE-2026-104286

    Fortinet's advisory FG-IR-26-175 was updated on 7 October with fixed builds for three branches. FortiMail 7.2 gets no fix and must move to 7.4 or later; Cloud is already patched.

  4. 4Security advisories

    Tenable fixes critical command injection in Identity Exposure SaaS

    The fix ships in SaaS 3.126.0, but the Active Directory listener must also be uninstalled and reinstalled before the flaw is closed. Tenable credits an outside researcher.

  5. 5Security advisories

    AhsayCBS backup flaws exploited to plant miners, no patch confirmed

    Huntress saw the first attack at 23:20 UTC on 7 October, three days after the CVEs were published; the console is popular with managed service providers.

  6. 6Security advisories

    AWS CDK fixes a symlink flaw in Docker asset bundling in 2.267.0

    Every aws-cdk-lib release before 2.267.0 is affected, and the bulletin offers an audit-your-containers workaround for teams that cannot upgrade immediately. AWS does not state a severity score.

  7. 7Security advisories

    Nvidia DCGM Exporter flaw can crash GPU monitoring, fixed in 4.8.2

    Researchers found about 2,100 internet-exposed GPU servers in scans between March and May. Nvidia rates the bug 8.2 and shipped the fix in September; no attacks are reported.

Funding and deals3

This group on its own

  1. 1Funding news

    Arena raises $200M Series B led by Lightspeed and Khosla

    The AI model leaderboard began as a UC Berkeley research project in 2023 and says it now logs tens of millions of monthly visitors from more than 150 countries.

  2. 2Funding news

    Henry raises 1.2 billion yen from regional banks for hospital software

    Shizuoka Bank arranged 1.1 billion yen of the round as a syndicated loan from five regional banks; two bank-linked venture funds added 100 million yen of equity.

  3. 3Funding news

    Klarent raises $8m to bring AI-written software tests to the US

    The Zurich company bills customers only for verified test outcomes and counts JD Sports, NZZ and Sixt as customers; its founders are ex-Google engineers.

Our research3

This group on its own

  1. 1Blog

    Only 2 of 47 software deals we covered addressed customer contracts

    17 of the 47 promised continuity, 10 gave a price and one gave a date on which part of a product stops. None paired a continuity promise with a word on contracts, data processing or hosting.

  2. 2Blog

    How to tell if the software you host yourself is still patched

    A method for checking vendor lifecycle pages, advisory feeds and the CISA exploited-vulnerabilities catalog against the versions you run, built on five old flaws added to the catalog on 8 October 2026.

  3. 3Blog

    Only 7 of 345 described launches say where the maker is based

    Our launch board also shows that 29 of 37 products calling themselves open source name no licence, and 30 of 36 products found through Hacker News rest on the maker's own word alone.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy