Skip to content
TrustList

TrustList daily digest

Thursday, 22 October 2026

Everything TrustList published on this day, 31 stories, grouped by subject and each in a line of our own.

News12

This group on its own

  1. 1News

    Studio breach may have exposed every account's API keys and form data

    The Japanese no-code site builder says an attacker reached its cloud environment on 30 September and 1 October and read the key that decrypts stored secrets. Japan's Digital Agency says its own site was affected.

  2. 2News

    Railway says an attacker reached customer secrets; rotate them all

    The hosting platform paused all deployments after finding access to stored environment variables, some decrypted. It links the attack to a campaign against AI inference providers and tells every user to roll keys.

  3. 3News

    Arc browser stops working on 22 December; new accounts closed now

    The Browser Company is retiring Arc to focus its security work on Dia. AI features on mobile go on 23 November, and Arc accounts are deactivated at the end with personal data deleted within 30 days.

  4. 4News

    GoDaddy misses deadline to revoke 404,607 mis-profiled TLS certificates

    The certificates are technically sound but did not match the policy GoDaddy published for its Starfield and GoDaddy hierarchies. Industry rules allowed five days; by 19 October 227,422 had been revoked.

  5. 5HR News

    BambooHR went offline for six hours to patch PHP, halting payroll work

    The HR platform pulled its US, Canadian and Irish services as a precaution against the critical PHP flaws on 21 October and came back after patching, saying the outage interrupted payroll.

  6. 6News

    Quad9 will withdraw its DNS service from France on 24 November

    A Paris court ordered the Swiss non-profit resolver to block sports piracy domains for beIN, cutting the penalty to €1,000 a day. Quad9 says it cannot block by country and will stop serving users in France.

  7. 7News

    Google Ads will pull landing-page images into new PMax ads by default

    From 4 December, new Performance Max campaigns are opted in to image extraction even where an account has dynamic images switched off. Advertisers who do not want it must opt out per campaign.

  8. 8HR News

    UK employers face a duty to stop third-party harassment from 30 October

    The government's updated Employment Rights Act timetable confirms the harassment and trade union measures for 30 October, with six-month unfair dismissal protection and uncapped awards following on 1 January 2027.

  9. 9News

    eMudhra quits the global TLS certificate business after its CA key leak

    The Bengaluru-listed trust company says its board chose to withdraw a week after eight intermediate keys were exposed. Its G1 RSA roots keep serving customers until they are moved to partners at no cost.

  10. 10Business news

    Opaque Systems winds down as its confidential AI team joins Anthropic

    The Berkeley RISELab spin-out is closing its business; its open-source agent trust projects carry on at AgenTrust and its summit moves to the Linux Foundation. Customers need a migration plan.

  11. 11News

    91APP database attack spreads to brands as Taiwan opens an inspection

    The Taiwanese e-commerce platform says data was taken from its Commerce Cloud database; brands using it report scam emails quoting real orders, and Taiwan's Digital Industry Administration has inspected the company.

  12. 12News

    Onamae Desktop Cloud shuts all servers after intrusion on 26,739

    GMO Internet's Windows desktop cloud found malicious programs on customer servers on 20 October and is stopping every plan with no restart date. Customers are told to change stored credentials.

Tech and security8

This group on its own

  1. 1Security advisories

    Splunk Enterprise and SOAR fix critical flaws scoring up to 9.9

    Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16 and SOAR 8.7.0 close internally found flaws, an unauthenticated crash of Splunk Web and a sidecar password any low-privileged user could derive.

  2. 2Security advisories

    Oracle patches a CVSS 9.1 Java TLS flaw in an out-of-cycle alert

    CVE-2026-91403 in JSSE can be exploited over the network with no login. Every listed build is affected, including 25.0.5 and 21.0.13, so Java estates need to patch again.

  3. 3Security advisories

    PAN-OS and Panorama are hit by the PHP flaws, with no fix date yet

    Palo Alto lists every supported PAN-OS line and Panorama as affected by CVE-2026-109618 and CVE-2026-109619 through the management interface. Threat Prevention signatures and access limits are the stopgaps.

  4. 4Security advisories

    AWS fixes an agent SDK flaw that mixed up callers' conversations

    Four AWS bulletins on 22 October: Strands Agents A2A servers leaked conversation history between callers, SAM CLI's Terraform hook allowed command injection, Athena exposed query text, and aws-c-mqtt could crash clients.

  5. 5Security advisories

    Apache Camel 4.22.1 users need 4.22.2 for seven more flaws

    A week after 38 advisories, Camel published seven more on 22 October, led by a High-rated XXE in camel-saxon. On the 4.22 LTS line only 4.22.2 fixes them; 4.18.5 and 4.23.0 already do.

  6. 6Security advisories

    Microsoft ties ConnectWise breach to Storm-0940 and an AI attack framework

    Microsoft says a China-aligned group used ARTEX, an open-source multi-agent pen-testing tool, to reach privileged cloud access in under three hours in some cases, and lists the Entra checks every affected tenant should run.

  7. 7Security advisories

    QPACK flaws let one connection exhaust memory on HTTP/3 servers

    FoxIO found seven of ten HTTP/3 stacks open to header amplification. quic-go, Cloudflare quiche, lsquic and Wireshark are fixed; Bun, the h3 crate and aioquic are not, and a proof of concept is public.

  8. 8Security advisories

    Laravel fixes an API token bypass that hands over any account

    CVE-2026-114509 lets an attacker with no token log in as an existing user on apps using TokenGuard with MySQL or MariaDB. Upgrade to 13.29.0 or 12.68.0; a proof of concept is public.

Sectors1

This group on its own

  1. 1Autonomous Vehicles & Mobility

    Volvo Cars adopts NVIDIA Hyperion as NVIDIA adds a safety evidence framework

    At GTC Berlin NVIDIA named Volvo Cars, Mercedes-Benz, Bolt, Einride and others building on its driving platform, and launched Halos SAFE to turn testing into traceable safety evidence.

Funding and deals10

This group on its own

  1. 1Funding news

    Cygrid raises €2.66m to stop risky actions by AI agents and tokens

    Atlantic leads the pre-seed for the Berlin start-up founded in January 2026, whose platform maps human, machine and agent identities and blocks or rewrites actions before they run.

  2. 2Funding news

    Azoma raises $11.2m Series A to get brands picked by AI shopping agents

    The Toronto and London company, a 2023 Techstars graduate, follows a $4m seed from December 2025. It says revenue grew almost tenfold in a year and counts L'Oréal, Unilever and Mars as customers.

  3. 3Funding news

    PataBid raises $2m pre-seed for AI estimating aimed at trade contractors

    The Calgary company sells Quantify to electrical, mechanical, plumbing and fire protection contractors from $2,460 a year and plans to launch a conversational estimating agent in 2027.

  4. 4Funding news

    Mach9 raises $34m Series A to turn road scans into engineering drawings

    The Carnegie Mellon spin-out began by building scanning hardware and switched to AI CAD software about two years ago. It says nearly 100 customers, including Caltrans, now use it.

  5. 5Funding news

    Firstwork raises $15m Series A for AI agents that onboard frontline staff

    Earlybird leads the round for the 2024 start-up, whose agents handle right-to-work checks, documents and training for more than 150,000 frontline workers a month. Deel Ventures joins.

  6. 6Funding news

    Ultra Security raises $10m seed to police what AI agents do

    The Michigan start-up, founded in 2025 by Trustpage founder Chase Lee, sits between agents and their tools to enforce policy on every call. Ludlow Ventures and Detroit Venture Partners are among its backers.

  7. 7Funding news

    Reduck raises $3m pre-seed so AI agents can run browser scripts

    Daphni leads the round for the French-American start-up founded by the team behind Mithril Security and the LaVague web agent. Its library holds more than 1,200 scripts for over 250 websites.

  8. 8Funding news

    Kaminashi raises ¥2.21bn Series C to link factory floor data to management

    Incubate Fund leads the round for the Tokyo frontline software maker, taking its equity funding to about ¥6.1bn. A production results product launches in November and Kirin Group Logistics is the first Project Lux customer.

  9. 9Funding news

    Flapping Airplanes raises a $1bn Series A for data-efficient AI models

    The young AI lab says it spent a year building new GPU primitives to cut how much data models need. Index and Lux co-lead, nine months after a $180 million seed.

  10. 10Funding news

    Weflayr raises $2.5m pre-seed to route AI calls to the best model

    13books Capital leads the round for the Station F start-up from former Mangopay chief executive Romain Mazeries, which benchmarks models on a customer's own traffic and routes each request within approved limits.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy