TrustList daily digest · News

Tuesday, 20 October 2026

News: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

News28

1HR News
Singapore asks for 6% to 8% raises for lower-wage workers from December
The National Wages Council guidelines run from 1 December 2026 to 30 November 2027 and add a category for unprofitable firms, which should still give at least $120; the wage credit scheme now runs to 2028.
2News
PostgreSQL retires its RPM repositories for RHEL 10.0 and 9.6
Packages for those minor releases, including PostgreSQL 18, move to the YUM archive and get no further updates; servers on RHEL, Rocky Linux or AlmaLinux 10.0 or 9.6 should move to a newer minor release.
3News
CMA proposes making Apple open iPhone NFC to UK wallets and apps
The proposed conduct requirement would make Apple offer host card emulation as well as the secure element, on fair terms and at fees "substantially lower" than today's; responses are due by 17 November.
4News
eMudhra revokes eight intermediates for compromise; Go distrusts them
The CCADB lists all eight emSign G3B and G3C issuing CAs as revoked for CA compromise on 18 October, Sectigo revoked its cross-signs a day later, and Go 1.27.3 and 1.26.10 block chains through them.
5News
Heroku-22 reaches end of life on 30 April 2027; move apps now
Heroku repeated the deadline alongside a 20 October update to all three stacks; buildpack apps get fixes automatically, but apps on the container stack must rebuild their Docker images.
6News
HubSpot developer CLI needs Node.js 22 or later from 8 January 2027
Node.js 22, the minimum HubSpot names, itself reaches end of life on 30 April 2027, so teams upgrading CI runners now have a reason to go straight to Node.js 24.
7News
Spain opens consultation on the EU Kids Act and its under-15 account ban
The proposed regulation would bar under-15s from holding their own social media and video accounts and add safety-by-design duties for games, AI companions, chatbots and app stores; comments close 4 November.
8News
ITEA software R&D call: project outlines due 2 November
The Eureka cluster funds international software projects country by country; French SMEs and mid-caps can ask Bpifrance for €50,000 to €3 million, and full proposals follow on 11 February 2027.
9News
BSC AI Factory opens accelerator for 100 Spanish AI startups
The 14-week programme, funded with €2.3 million by Spain's digital ministry, gives selected startups MareNostrum 5 supercomputer time and mentoring with partners Nvidia and AWS; applications close 9 November.
10News
OpenAI removes GPT-4o and GPT-4.1 models from its API on 14 January
Four GPT-4 series models and their fine-tunes stop working in the API on 14 January 2027, with gpt-6-luna named as the replacement for all of them; text-to-speech and Whisper retirements follow close behind.
11News
Poland delays KSeF error penalties to 2028 as e-invoicing goes universal
The Council of Ministers backs a bill that keeps fines for KSeF mistakes on hold until 31 December 2027, while the last exemption, for firms invoicing up to PLN 10,000 a month, ends with 2026.
12Business news
Salesforce agrees to buy Braze for about $5.66bn in cash
Braze shareholders get $47.50 a share; the customer engagement platform, used by about 2,770 brands including Canva and Instacart, would join Marketing Cloud, with closing expected in Salesforce's fiscal 2028.
13News
FedRAMP proposes looser crypto rule for Class D and asks about FOCI
RFC-0035 would let top-tier cloud services use crypto outside NIST validation if documented, and RFC-0036 sets pilot rules including foreign-ownership indicators; comments close 17 and 19 November.
14News
Zeabur shuts its deployment platform by 31 December after a breach
The Taiwan-founded platform says an attacker read 3.2 million stored environment variables and 321,810 account records in October; services pause from 1 December, and the data deletion date is not yet set.
15News
Meta terms let its crawlers index business websites from 20 November
Every Page, ad account and shop on Facebook, Instagram or WhatsApp accepts the new clause by carrying on; the only opt-out Meta offers is a robots.txt rule for its ads crawler.
16News
Atlassian cloud adds new IP ranges on 1 January; update your allowlists
Firewalls that allowlist Atlassian by address must add 131.162.88.0/23 for traffic to Atlassian and 131.162.90.0/23 for webhooks and app calls from it, or integrations may break when the ranges go live.
17News
Google shuts its Deep Research Pro preview agent on 23 October
Calls to deep-research-pro-preview-12-2025 stop working on 23 October; the same release notes quietly reroute two retired Flash model names to newer models, which changes output without any code change.
18News
Poland makes Apple drop "tracking" from its app consent prompts
UOKiK's commitments decision DOK-7/2026 makes Apple use the same neutral prompt for its own apps and everyone else's in Poland, and sets up an independent liaison officer for app makers' complaints.
19Business news
Aikido buys Cyberly and Outkept to launch Noon for employee security
The Ghent developer-security company bought the Warsaw attack-simulation start-up and the Belgian phishing-training firm in September; Noon combines email security, AI governance and device protection.
20News
China tells platforms with millions of minors to file within 20 days
The Cyberspace Administration starts designating services with 10 million registered or 1 million monthly active minor users; qualifying providers must send a self-assessment to their provincial office.
21News
Switzerland tenders its government cloud, up to CHF 7bn in three lots
The federal IT office splits the Swiss Government Cloud into two public-cloud lots and one private cloud in federal data centres; no supplier may win more than one, and prequalification runs 60 days.
22News
NY and Connecticut fine a pediatric network and its IT provider $2.7m
XTIUM's 2024 breach reached 18 client networks; the attorneys general found weak logging of its remote support account, no vendor security programme at BCHP and an unencrypted archive of a million billing records.
23News
Vercel terms now expire credits and give UK and EU users a cancel right
The rewrite took effect the day it was posted: plan credits end with the term, bought credits after a year, and a company can take over an account on its email domain after notice.
24News
Canada's privacy watchdog sets out its first Children's Privacy Code
The code expects parental consent under 13, opt-in for non-essential uses, no profiling of children for ads or AI decisions and privacy settings off by default; comments are open until 20 January 2027.
25News
39 attorneys general ask court to shield Character.AI user data in sale
Led by North Carolina, the coalition wants users able to see and delete their chats before any sale of the chatbot company's assets, and limits on how a buyer could use private conversations, including children's.
26HR News
Bullhorn restores its staffing platform after a three-day cyber incident
Recruiters on the ATS and CRM lost access from 17 October while CrowdStrike investigated; every region was back by 20 October, and Bullhorn has not yet said whether customer data was taken.
27News
Safari 27 blocks third-party services that turn emails into tracking IDs
WebKit says Safari and WebKit on iOS, iPadOS, macOS and visionOS 27 cut off network access to identity resolution providers by domain, so marketers who rely on hashed-email IDs lose that signal from Apple users.
28HR News
Instacart pays $5m to settle claims its PERM hiring shut out US workers
The Justice Department and the EEOC say Instacart made applicants mail paper applications for jobs advertised in green-card recruitment, while its normal hiring accepted online applications.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.