Skip to content
TrustList

TrustList daily digest

Wednesday, 21 October 2026

Everything TrustList published on this day, 32 stories, grouped by subject and each in a line of our own.

News9

This group on its own

  1. 1News

    Croatia lets small firms issue e-invoices free before the 2027 mandate

    The Tax Administration's MIKROeRAČUN app can now issue and fiscalise eRačuni for taxpayers outside the VAT system, ahead of the legal obligation to issue e-invoices from 1 January 2027.

  2. 2News

    Swiss court: PostFinance needs express consent before taking voiceprints

    The Federal Administrative Court backs the data protection commissioner: staying on the line after a recording notice is not consent. PostFinance has until mid-February 2027 to get consent or delete.

  3. 3News

    Chrome now asks permission before every insecure HTTP connection

    The warning first shipped to Enhanced Protection users and is now on by default for everyone. Single-label intranet names and local IP addresses are exempt, but internal sites on public domains are not.

  4. 4News

    EU opens Digital Services Act case against Booking.com over scams

    The Commission will examine fake listings, phishing that abuses guest data shared with hotels, and whether paid visibility through higher commission is labelled as advertising.

  5. 5News

    Hamburg makes its privacy regulator the AI Act watchdog for city agencies

    From 1 January 2027 the HmbBfDI supervises AI systems that Hamburg's public bodies buy, deploy or use, from police biometrics to school grading, and offers regulatory sandboxes. Private firms stay with the Bundesnetzagentur.

  6. 6News

    Microsoft 365 Apps version 2611 removes Publisher from November

    Subscribers lost Publisher on 1 October, but the removal update only reaches Current Channel in mid-November and Monthly Enterprise in early December. Microsoft says the gap is not an extension.

  7. 7News

    auDA says existing .com.au holders keep current rules under reform

    A panel wants com.au and net.au names to match a personal name, registered name or trade mark. auDA now proposes that no current licence is affected, with draft rules out for consultation later this year.

  8. 8News

    TeamUpdraft breach exposes UpdraftCentral keys that can command WordPress sites

    Customer records, hashed passwords and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone were taken in a weekend intrusion. UpdraftPlus 1.26.13 and 2.26.13 cut every old UpdraftCentral link.

  9. 9News

    curl will handle low and medium security bugs in public from 26 October

    Faced with a flood of vulnerability reports, the curl project keeps only High and Critical issues private on HackerOne. Everything else goes to public GitHub issues, and old reports will be disclosed.

Tech and security13

This group on its own

  1. 1Security advisories

    Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw

    E-Business Suite alone gets 194 patches, 31 of them exploitable without a login, led by an Application Object Library flaw rated 9.8. Fusion Middleware gets 206, MySQL 98 and Java SE 55.

  2. 2Security advisories

    PHP fixes two critical remote code execution flaws, update now

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close CVE-2026-109618 and CVE-2026-109619. Every PHP install serving web requests is at risk, mod_php most of all, and PHP 8.1 and older get no official fix.

  3. 3Security advisories

    SafePay ransomware has hit 600 victims, says joint FBI and CISA advisory

    US, German and UK agencies list the five edge and backup flaws the group exploits, and warn that it resets backup storage to factory settings before encrypting.

  4. 4Security advisories

    Node.js fixes a Brotli remote code flaw and two TLS hostname bypasses

    Releases 26.12.1, 24.22.1 and 22.23.4 close ten CVEs, four rated High, and also drop trust in the compromised eMudhra intermediates through the bundled CA store.

  5. 5Security advisories

    Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up

    Two flaws rated Important hit all three supported lines, a third affects only Tomcat 11, and the fixed releases have been out since 12 October.

  6. 6Security advisories

    Chrome 156 ships 353 security fixes, six of them rated Critical

    Six Critical memory bugs in Skia, Accessibility, CSS, Paint and WebRTC lead the list, with 61 High, 197 Medium and 89 Low. Google gave no sign of exploitation in the wild.

  7. 7Security advisories

    GitLab ships another CVSS 10 regex fix, update to 19.5.1 now

    CVE-2026-110264 lets an attacker with no login run code by compiling a crafted regular expression. Fixes reach back to 18.11.13, and a High flaw allows takeover of LDAP-backed accounts.

  8. 8Security advisories

    Ransomware gangs exploit a PAN-OS GlobalProtect bypass fixed since May

    Unit 42 ties Qilin and Inc intrusions to CVE-2026-0257, an authentication bypass that opens VPN sessions without credentials, and in one case a pivot to vCenter and ESXi.

  9. 9Security advisories

    Cisco Expressway clusters open to root code execution, fixed in X15.5.20

    CVE-2026-76466 scores 9.8 and needs no login: persistent cookies and weak certificate checks between cluster peers reach the database service. There is no workaround, and X14 users must migrate.

  10. 10Security advisories

    OVHcloud CLI downloads were swapped for a stealer for 94 minutes

    A hijacked contributor account replaced the macOS, Linux and Windows binaries of five releases on GitHub; v0.16.0 is a clean, attested rebuild, and anyone who installed in the window should rotate secrets.

  11. 11Security advisories

    BIND 9.20.30 fixes four High flaws, one may allow remote code execution

    ISC's October release closes a GSS-TSIG replay that corrupts memory and three resolver crashes. No 9.18 build is listed, so 9.18 users must move to 9.20.30.

  12. 12Security advisories

    Craft CMS sites need 5.11.0 or 4.18.8 to close Twig sandbox code flaws

    Nine advisories published on 5 October cover four high-severity code execution paths through the Twig sandbox; Canada's Cyber Centre urged updates on 20 October. The fixes have been out since 1 September.

  13. 13Security advisories

    LiteLLM 1.107.0 shipped a credential stealer on PyPI and Docker

    Attackers used stolen GitHub tokens from three engineers to publish poisoned builds for about two hours. Pin 1.106.2, clean the files by hand before running Python, and rotate every key the proxy held.

Sectors1

This group on its own

  1. 1Autonomous Vehicles & Mobility

    Bolt picks NVIDIA software for robotaxis, starting in Madrid in 2027

    The ride-hailing company will run Lucid cars on NVIDIA's Alpamayo Stack, first collecting driving data in Madrid, as the base for at least 25,000 Level 4-ready vehicles and a target of 100,000 by 2035.

Funding and deals9

This group on its own

  1. 1Funding news

    Blacksmith raises a Sequoia-led Series C at a $1bn valuation

    The CI cloud has raised $125 million in total and says it now runs more than 90 million jobs a week, up from 5 million in January, as coding agents push more code through the pipeline.

  2. 2Funding news

    Legora raises $550m at an $8.8bn valuation as legal AI passes $200m ARR

    Founded in 2023, the legal AI platform was valued at $5.6 billion in its last round; the US is now its largest market, with more than half of the AmLaw 50 as customers.

  3. 3Funding news

    Pigment raises $250m at a $2.3bn valuation to put agents into planning

    The Paris-built planning platform passed $100 million in annual recurring revenue this year, and the new money goes into Graphite, the compute engine its AI agents run on.

  4. 4Funding news

    AuxoAI raises $20.7m Series A led by NTTVC for forward-deployed AI teams

    Founded in 2023 and based in the San Francisco Bay Area with offices in four Indian cities, AuxoAI sends strategists and engineers into Global 2000 firms to build production AI.

  5. 5Funding news

    Eka Robotics raises $150m to teach robot hands physics, not imitation

    a16z and F-Prime lead the Series A, with seed leads Obvious Ventures and E14 Fund following on. Eka claims 1,500 picks an hour, about two and a half times a human baseline.

  6. 6Funding news

    Nutanix co-founder's Different launches with $48m for AI-run demand gen

    General Catalyst leads and Lightspeed joins. Ajeet Singh, who co-founded Nutanix and ThoughtSpot, spent a year refining the system with early customers before showing it.

  7. 7Funding news

    VECKTA raises $11m Series A to help companies buy onsite solar and storage

    The San Diego platform, which says it is profitable, turns a property address into a business case in under a minute and runs standardised tenders across more than 3,000 vetted suppliers.

  8. 8Funding news

    Asymptote Labs raises $5.5m seed to watch what AI coding agents do

    Tower Research Ventures leads; its parent's security team is already testing Beacon, the open-source agent telemetry layer the round funds. The founders built detection systems at Doppel.

  9. 9Funding news

    Qualitate raises $25m Series A from Insight Partners for AI expert interviews

    Insight was a paying customer before it led the round. Qualitate says its revenue run-rate grew more than tenfold this year after just over a year on sale.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy