Skip to content
TrustList

TrustList daily digest

Tuesday, 20 October 2026

Everything TrustList published on this day, 56 stories, grouped by subject and each in a line of our own.

News28

This group on its own

  1. 1HR News

    Singapore asks for 6% to 8% raises for lower-wage workers from December

    The National Wages Council guidelines run from 1 December 2026 to 30 November 2027 and add a category for unprofitable firms, which should still give at least $120; the wage credit scheme now runs to 2028.

  2. 2News

    PostgreSQL retires its RPM repositories for RHEL 10.0 and 9.6

    Packages for those minor releases, including PostgreSQL 18, move to the YUM archive and get no further updates; servers on RHEL, Rocky Linux or AlmaLinux 10.0 or 9.6 should move to a newer minor release.

  3. 3News

    CMA proposes making Apple open iPhone NFC to UK wallets and apps

    The proposed conduct requirement would make Apple offer host card emulation as well as the secure element, on fair terms and at fees "substantially lower" than today's; responses are due by 17 November.

  4. 4News

    eMudhra revokes eight intermediates for compromise; Go distrusts them

    The CCADB lists all eight emSign G3B and G3C issuing CAs as revoked for CA compromise on 18 October, Sectigo revoked its cross-signs a day later, and Go 1.27.3 and 1.26.10 block chains through them.

  5. 5News

    Heroku-22 reaches end of life on 30 April 2027; move apps now

    Heroku repeated the deadline alongside a 20 October update to all three stacks; buildpack apps get fixes automatically, but apps on the container stack must rebuild their Docker images.

  6. 6News

    HubSpot developer CLI needs Node.js 22 or later from 8 January 2027

    Node.js 22, the minimum HubSpot names, itself reaches end of life on 30 April 2027, so teams upgrading CI runners now have a reason to go straight to Node.js 24.

  7. 7News

    Spain opens consultation on the EU Kids Act and its under-15 account ban

    The proposed regulation would bar under-15s from holding their own social media and video accounts and add safety-by-design duties for games, AI companions, chatbots and app stores; comments close 4 November.

  8. 8News

    ITEA software R&D call: project outlines due 2 November

    The Eureka cluster funds international software projects country by country; French SMEs and mid-caps can ask Bpifrance for €50,000 to €3 million, and full proposals follow on 11 February 2027.

  9. 9News

    BSC AI Factory opens accelerator for 100 Spanish AI startups

    The 14-week programme, funded with €2.3 million by Spain's digital ministry, gives selected startups MareNostrum 5 supercomputer time and mentoring with partners Nvidia and AWS; applications close 9 November.

  10. 10News

    OpenAI removes GPT-4o and GPT-4.1 models from its API on 14 January

    Four GPT-4 series models and their fine-tunes stop working in the API on 14 January 2027, with gpt-6-luna named as the replacement for all of them; text-to-speech and Whisper retirements follow close behind.

  11. 11News

    Poland delays KSeF error penalties to 2028 as e-invoicing goes universal

    The Council of Ministers backs a bill that keeps fines for KSeF mistakes on hold until 31 December 2027, while the last exemption, for firms invoicing up to PLN 10,000 a month, ends with 2026.

  12. 12Business news

    Salesforce agrees to buy Braze for about $5.66bn in cash

    Braze shareholders get $47.50 a share; the customer engagement platform, used by about 2,770 brands including Canva and Instacart, would join Marketing Cloud, with closing expected in Salesforce's fiscal 2028.

  13. 13News

    FedRAMP proposes looser crypto rule for Class D and asks about FOCI

    RFC-0035 would let top-tier cloud services use crypto outside NIST validation if documented, and RFC-0036 sets pilot rules including foreign-ownership indicators; comments close 17 and 19 November.

  14. 14News

    Zeabur shuts its deployment platform by 31 December after a breach

    The Taiwan-founded platform says an attacker read 3.2 million stored environment variables and 321,810 account records in October; services pause from 1 December, and the data deletion date is not yet set.

  15. 15News

    Meta terms let its crawlers index business websites from 20 November

    Every Page, ad account and shop on Facebook, Instagram or WhatsApp accepts the new clause by carrying on; the only opt-out Meta offers is a robots.txt rule for its ads crawler.

  16. 16News

    Atlassian cloud adds new IP ranges on 1 January; update your allowlists

    Firewalls that allowlist Atlassian by address must add 131.162.88.0/23 for traffic to Atlassian and 131.162.90.0/23 for webhooks and app calls from it, or integrations may break when the ranges go live.

  17. 17News

    Google shuts its Deep Research Pro preview agent on 23 October

    Calls to deep-research-pro-preview-12-2025 stop working on 23 October; the same release notes quietly reroute two retired Flash model names to newer models, which changes output without any code change.

  18. 18News

    Poland makes Apple drop "tracking" from its app consent prompts

    UOKiK's commitments decision DOK-7/2026 makes Apple use the same neutral prompt for its own apps and everyone else's in Poland, and sets up an independent liaison officer for app makers' complaints.

  19. 19Business news

    Aikido buys Cyberly and Outkept to launch Noon for employee security

    The Ghent developer-security company bought the Warsaw attack-simulation start-up and the Belgian phishing-training firm in September; Noon combines email security, AI governance and device protection.

  20. 20News

    China tells platforms with millions of minors to file within 20 days

    The Cyberspace Administration starts designating services with 10 million registered or 1 million monthly active minor users; qualifying providers must send a self-assessment to their provincial office.

  21. 21News

    Switzerland tenders its government cloud, up to CHF 7bn in three lots

    The federal IT office splits the Swiss Government Cloud into two public-cloud lots and one private cloud in federal data centres; no supplier may win more than one, and prequalification runs 60 days.

  22. 22News

    NY and Connecticut fine a pediatric network and its IT provider $2.7m

    XTIUM's 2024 breach reached 18 client networks; the attorneys general found weak logging of its remote support account, no vendor security programme at BCHP and an unencrypted archive of a million billing records.

  23. 23News

    Vercel terms now expire credits and give UK and EU users a cancel right

    The rewrite took effect the day it was posted: plan credits end with the term, bought credits after a year, and a company can take over an account on its email domain after notice.

  24. 24News

    Canada's privacy watchdog sets out its first Children's Privacy Code

    The code expects parental consent under 13, opt-in for non-essential uses, no profiling of children for ads or AI decisions and privacy settings off by default; comments are open until 20 January 2027.

  25. 25News

    39 attorneys general ask court to shield Character.AI user data in sale

    Led by North Carolina, the coalition wants users able to see and delete their chats before any sale of the chatbot company's assets, and limits on how a buyer could use private conversations, including children's.

  26. 26HR News

    Bullhorn restores its staffing platform after a three-day cyber incident

    Recruiters on the ATS and CRM lost access from 17 October while CrowdStrike investigated; every region was back by 20 October, and Bullhorn has not yet said whether customer data was taken.

  27. 27News

    Safari 27 blocks third-party services that turn emails into tracking IDs

    WebKit says Safari and WebKit on iOS, iPadOS, macOS and visionOS 27 cut off network access to identity resolution providers by domain, so marketers who rely on hashed-email IDs lose that signal from Apple users.

  28. 28HR News

    Instacart pays $5m to settle claims its PERM hiring shut out US workers

    The Justice Department and the EEOC say Instacart made applicants mail paper applications for jobs advertised in green-card recruitment, while its normal hiring accepted online applications.

Tech and security9

This group on its own

  1. 1Security advisories

    FortiSIEM 7.5.0 has a critical unauthenticated file-write flaw

    CVE-2026-106173, rated 9.4, lets an attacker write files through the phQueryMaster gRPC service on TCP port 27918; 7.5.1 fixes it, 7.6 and FortiSIEM Cloud are not affected.

  2. 2Security advisories

    Thunderbird fix stops Exchange setup sending passwords over plain HTTP

    Thunderbird 158.0.1 and 153.5.1 fix three high-rated flaws, including XMPP stanza injection and an NTLM memory leak; Firefox 158.0.1 and both ESRs build in the block on compromised eMudhra intermediates.

  3. 3Security advisories

    Roundcube 1.7.5 and 1.6.20 fix 20 flaws, including IMAP injection

    The webmail project fixes command and header injection, an SSRF filter bypass, object injection in sessions and a password driver that could change another user's password; Italy's ACN rates the IMAP flaw high.

  4. 4Security advisories

    Siemens Software Center flaw exploited through signed copies

    Attackers bundle a genuine, signed copy of the installer tool with a malicious DLL in a ClickFix campaign; version 4.0.9.8 fixes CVE-2026-110936 and installs itself on the next start.

  5. 5Security advisories

    Shopware 6.7 media upload flaw can hand attackers the admin, no patch yet

    CERT/CC says HTML files uploaded as media are served without protective headers, letting a user with upload rights steal an administrator's token and, with plugin rights, run PHP code; it could not reach Shopware.

  6. 6Security advisories

    Zoom fixes three high-severity flaws in Workplace and Rooms apps

    A Zoom Phone buffer overflow, CVE-2026-53420, scores 8.0, and two certificate validation flaws in the Windows app and the My Notes feature score 7.4; version 7.2.0 or the 7.1.9 branch fixes them.

  7. 7Security advisories

    Advantech fixes 30 flaws in ADAM-3600 controllers, some rated 9.3

    EdgeLink v2.8.5.0 closes CVE-2026-43829 to 43858 in the industrial edge controller, including stack overflows and forged firmware uploads; Canada's Cyber Centre flagged the advisory on 20 October.

  8. 8Security advisories

    CERT/CC finds TLS libraries disagree on certificate name constraints

    Thirteen records across GnuTLS, OpenSSL, Go, NSS, wolfSSL, pyca/cryptography and others; fixes are out for three libraries, and CERT/CC stresses that a disagreement alone is not an exploit.

  9. 9Security advisories

    AOMEI update servers were hijacked for minutes at a time to push malware

    Google's threat team says UNC7017 rewrote AOMEI Backupper and AnyViewer update files for five to ten minutes at a time between April and July 2026; the vendor's server fix does not clean infected PCs.

Sectors11

This group on its own

  1. 1Modern Cars

    BMW shows 460 kW charging for the iX5, but the US chargers are not on sale

    The first electric X5 adds up to 217 miles (WLTP) in ten minutes on an Alpitronic demonstrator at an IONNA site; Alpitronic says the 460 kW hardware is not commercially available in the US today.

  2. 2Autonomous Vehicles & Mobility

    Nissan runs Kobe self-driving ride pilot from 8 December, aims to charge in 2027

    Level 2 Serena vans with a safety driver will serve Kobe's Nada Gogo sake district on weekdays to 18 December, booked by smartphone and watched from Nissan's Yokohama remote operations centre.

  3. 3Robotics & Automation

    AGCO to pilot Agility's Digit humanoid at its Kansas plant in 2027

    The tractor maker's commercial agreement puts Digit on parts sorting and tote handling at Hesston; Agility, whose SPAC listing goes to a shareholder vote on 2 November, says it has nine committed customer sites.

  4. 4Robotics & Automation

    Germany signs a physical AI pact with NVIDIA; Agile Robots gets backing

    Chancellor Merz and two federal ministries agreed a joint initiative on AI models for physical AI; NVIDIA also announced planned investments in Munich robot maker Agile Robots and three other German startups.

  5. 5Autonomous Vehicles & Mobility

    Waymo starts driving in the Madrid region, aiming for riders in 2027

    Waymo's electric Jaguars start with manual driving and then validation with trained specialists at the wheel; a paid driverless service will still need a Spanish passenger-transport authorisation.

  6. 6Robotics & Automation

    SPRIND's robotics challenge closes 22 October with up to €7.2m a team

    Germany's innovation agency also has an AI chip design challenge with the Dutch NADI, worth up to €9.6 million a team and open to 30 November, plus quantum sensing and biomanufacturing calls.

  7. 7Robotics & Automation

    NEURA Robotics launches Neuron AI, a robot model that hears and feels

    The Metzingen company's model combines 3D vision, touch, force, audio and language with memory, runs on five of its robots, and is fine-tuned by customers through its Neuraverse platform.

  8. 8Modern Cars

    NHTSA picks 2027 cars for crash, pedestrian and driver-assist tests

    23 models face frontal, side and rollover tests, 18 the new pedestrian protection assessment and 10 checks of five driver-assistance systems, including the Tesla Model 3, Rivian R2 and Kia EV3.

  9. 9Autonomous Vehicles & Mobility

    Albuquerque becomes sixth FAA test site for autonomous and eVTOL flight

    Under the eVTOL Integration Pilot Program, Reliable Robotics flew cargo demonstrations at Albuquerque International Sunport with a remotely piloted Cessna Caravan; the FAA may use the data to write new rules.

  10. 10Autonomous Vehicles & Mobility

    Kodiak driverless truck ran 64 days without shutting down

    The record came on an unsupervised truck in the 35-strong Atlas Energy fleet in the Permian Basin; Kodiak still plans a driverless highway launch on Interstate 45 between Dallas and Houston by year end.

  11. 11Robotics & Automation

    Hyundai and Kia show 200 factory technologies for software-defined plants

    E-FOREST TECH DAY at the Uiwang research institute showed digital twins of real equipment, AI agents for factory staff and an in-house vision system for inspecting finished cars, all to be rolled out in Korea and abroad.

Funding and deals8

This group on its own

  1. 1Funding news

    Town raises $108m Series B at a $1bn valuation for team AI assistants

    Forerunner and Menlo co-led the round four months after a $55 million Series A; Town says paying teams are up ninefold since July, and each employee gets an assistant that works with colleagues' assistants.

  2. 2Funding news

    Daytona raises $60m at a $1bn valuation to run computers for AI agents

    FirstMark Growth leads the Series B, taking total funding to $91 million; Daytona says revenue has grown about 25 times since January and customers include Meta, Cohere, Writer and n8n.

  3. 3Funding news

    Blackwall raises $100m at a $2.2bn valuation for hosts' traffic security

    AVP leads the Estonian company's Series C weeks after it was valued at €1 billion; its bot, DDoS and firewall layer runs inside hosting providers' own infrastructure and is resold under their brands.

  4. 4Funding news

    Plinto raises €2.9m to put AI agents on financial controls

    People Ventures and Emblem back the Copenhagen company, whose founders helped build Peakon, sold to Workday for over $700 million; its agents check orders, invoices and payments as they happen.

  5. 5Funding news

    XRlabs raises $8.4m seed to put AI software in operating rooms

    Playground Global leads the London company's round, Eka Ventures joins, and former Medtronic chief executive Omar Ishrak becomes chair; its software has been used in more than 100 operations.

  6. 6Funding news

    Dream Labs raises a $90m seed to sell a robot brain through an API

    B Capital and Kindred Ventures lead the round for the San Francisco company founded this year by former leads of NVIDIA's GR00T research; its Dream-1 model drives robot arms costing $2,000 to $10,000.

  7. 7Funding news

    Linkener raises €7.5m from Alantra's Klima fund for energy software

    The Valencia company, which says it serves more than 2,000 business customers and 10,000 supply points, will also use the round to buy complementary technology and service firms.

  8. 8Funding news

    Dapta raises $6m to sell AI sales agents to Spanish-speaking founders

    Chingona Ventures leads the seed round; Dapta says about 4,000 businesses join each week, its revenue run-rate has passed $4 million and it has paying customers in 26 countries.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy