Skip to content
TrustList

TrustList daily digest

Friday, 23 October 2026

Everything TrustList published on this day, 33 stories, grouped by subject and each in a line of our own.

News17

This group on its own

  1. 1News

    DuckDB 1.4 support ends 17 November as 2.0 LTS ships

    DuckDB 2.0 is supported until at least October 2027 and 1.5 has been extended to March 2027. Files written by 2.0 cannot be read by any older version, so upgrade order matters.

  2. 2Business news

    Cognizant agrees to buy DyFlex, an Australian SAP partner of 300 staff

    The deal adds an SAP Platinum Partner with offices across Australia and New Zealand and delivery in the Philippines. It is expected to close in the first quarter of 2027; terms were not disclosed.

  3. 3News

    Kenya blocks customs clearance without digital cargo insurance from 1 November

    KRA and the Insurance Regulatory Authority will enforce mandatory Digital Marine Cargo Insurance: the certificate must reach the iCMS customs system before a declaration is lodged, or the consignment is held.

  4. 4News

    Pakistan's PTA proposes 10-year radio licences decided in 15 working days

    The draft Radio Based Services Licensing Regulations 2026 cover private radio networks, microwave links and satellite services used by businesses. PTA wants comments by email by 4 November.

  5. 5News

    Brazil's deadline to opt into the regular IBS and CBS regime is 30 October

    The Receita Federal says 917,331 businesses had asked to use the new regime by 16 October; Simples Nacional firms refused by the 15 October cut-off have until 30 October to clear what blocked them.

  6. 6News

    OpenAI Evals goes read-only on 31 October; Agent Builder ends 30 November

    The Evals dashboard and API, the v1/prompts API and Agent Builder all shut down on 30 November. OpenAI points Evals users to Promptfoo and Agent Builder users to its Agents SDK; older image models go on 1 December.

  7. 7News

    Mexico orders platforms to verify ages and report compliance in 30 days

    A presidential decree in force since 14 October covers social networks, video games and app stores. Self-declared ages are no longer enough, and platforms must document their measures by 13 November.

  8. 8Business news

    Maggioli Group takes 20% of Turin clinical AI start-up DatAIMed

    The Italian public-sector software group joins through a capital increase reported at €1.2 million. DatAIMed answers clinicians' questions with cited sources and says it has more than 13,000 registered users.

  9. 9News

    UK proposes security duties and direction powers for subsea cable firms

    A White Paper would replace 140-year-old law with offences carrying up to 14 years in prison, statutory resilience duties for cable providers and a regime for sensing technology on fibre. Consultation runs 12 weeks.

  10. 10News

    Japan alert-mail service SpeeCAN RAIDEN breached, sent 1.4m phishing emails

    Arcadia, whose services carry subscriber alert mail, school notices and the NET119 emergency service, is reporting to Japan's privacy regulator on its customers' behalf and asks them to reissue LINE secrets.

  11. 11News

    Brazil's data regulator drafts fines for child safety and platform rules

    ANPD's draft extends its sanctions rulebook beyond the LGPD to the ECA Digital and the new Marco Civil decrees, including age checks. Comments close on 30 November; a public hearing is on 29 October.

  12. 12News

    Italy opens a €150m cloud and cybersecurity voucher for small firms

    Small businesses and self-employed professionals can claim up to half their spending, capped at €20,000, on cloud and security from registered suppliers. Applications open at noon on 10 November.

  13. 13News

    Australia sanctions North Korean IT-worker networks behind remote jobs

    Two people and two companies that place North Korean IT workers in remote contracts abroad are now on Australia's sanctions list. Paying them, even through a recruiter, can be a criminal offence.

  14. 14News

    Swiss regulator investigates pension software firm PK Softech after data theft

    Data from several large second-pillar pension funds, including the federal fund Publica, left PK Softech's systems in a late-September attack. The FDPIC wants to know what the funds handed over and why.

  15. 15News

    Nigeria tells device sellers: no type approval, no network access

    The NCC says every SIM-enabled device model sold in Nigeria needs type approval and each unit's IMEI must be verified before sale, with Customs checking imports. Non-compliant devices may be cut off.

  16. 16Business news

    Zoom buys Onyx, keeping its enterprise search open source

    Onyx, founded in 2023, connects to more than 50 business applications and feeds context to people and AI agents. Zoom says it stays standalone, model-agnostic and self-hostable inside Zoom AI Services.

  17. 17HR News

    Kenya raises the fringe benefit and deemed interest rates to 9%

    KRA's notice for October to December 2026 lifts both rates from 8%, which raises the taxable benefit on cheap staff loans. It was published three weeks into the quarter it covers.

Tech and security10

This group on its own

  1. 1Security advisories

    HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

    Seven CVE records scored 10.0 cover authentication bypass, command injection, SQL injection and buffer overflows that need no login. Fixed releases are 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24.

  2. 2Security advisories

    Ruby 4.0.9, 3.4.12 and 3.3.13 fix the regexp bugs behind GitLab RCEs

    Any Ruby application that builds a regular expression from user input is exposed to the memory corruption GitLab turned into code execution. Regexp.timeout is no defence; the fix is the new releases.

  3. 3Security advisories

    Arista VeloCloud flaw lets any logged-in user become a superuser

    CVE-2026-114625, rated critical (CVSS 4.0 score 9.4), affects on-premises VeloCloud Orchestrator. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted orchestrators are already patched.

  4. 4Security advisories

    Fortinet ships FortiOS fixes for AI-found flaws, details on 10 November

    FortiOS 7.6.8, 7.4.13 and 8.0.2 and matching FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator builds fix critical and high-severity bugs. Fortinet is withholding the advisories until Patch Tuesday.

  5. 5Security advisories

    Pillow 13.0.0 fixes heap overflow in its bundled OpenJPEG

    Every Pillow wheel from 11.1.0 to 12.3.0 ships its own copy of libopenjp2 with an out-of-bounds write reachable by simply opening an image. Patching the operating system does not help.

  6. 6Security advisories

    MongoDB C# driver 3.13.0 fixes 11 CVEs, some with public exploits

    The flaws range from NoSQL injection to silent loss of client-side encryption and shared connections across client certificates. Several fixes change driver behaviour, so test before upgrading.

  7. 7Security advisories

    Python security releases ship new pip to drop emSign trust

    Python 3.15.1, 3.14.9 and 3.13.17 bundle pip 26.2.2 with certifi 2026.10.19. Upgrading Python alone leaves existing virtual environments on the old pip and the old certificate bundle.

  8. 8Security advisories

    Pleasanter fixes LDAP login bypass CVE-2026-113438 in 1.5.9.1

    Anyone who knows a valid login ID can sign in without the password on Linux or Docker installs, and Windows with the Novell provider, against Active Directory or an LDAP server allowing anonymous bind.

  9. 9Security advisories

    PHP advises disabling session upload progress over CVE-2026-115560

    A third, unlikely remote code execution path follows this week's critical PHP fixes. The mitigation, session.upload_progress.enabled=0, was already in the CVE-2026-109619 advisory; no fixed release yet.

  10. 10Security advisories

    CERT Polska lists 11 CGM CLININET flaws, several still unfixed

    Patient documents could be listed and downloaded without logging in, and four paths lead to root on the hospital system server. Version 2026.MS3 fixes six of the eleven; the rest remain open.

Sectors1

This group on its own

  1. 1Modern Cars

    China drafts mandatory car data security and automated parking standards

    MIIT is consulting until 19 December on five mandatory national standards, including Automobile Data Security Requirements and safety rules for parking assistance and automated parking in connected cars.

Funding and deals5

This group on its own

  1. 1Funding news

    Tractian raises $130m Series D at $1.4bn for machine-health AI

    Sapphire Ventures leads again, with M&G's Catalyst co-leading. The Atlanta company, with offices in São Paulo, Monterrey and Poland, combines its own sensors with an agent that diagnoses failing machines.

  2. 2Funding news

    Cognitive Credit raises $40m from Summit Partners for credit data AI

    The London credit analytics firm, already used by most of the 25 largest asset managers, will push into the US and launch DealConnect for private issuers that report through data rooms.

  3. 3Funding news

    Syncrowin raises A$3m led by Collide Capital for industrial AI

    The Melbourne start-up builds what it calls an AI operating system for energy and manufacturing sites. Hustle Fund, POV Ventures, Co-Ventures and Ventari joined the oversubscribed round.

  4. 4Funding news

    Kevel raises $52m to scale retail media ad infrastructure

    Fulcrum Equity Partners, dunnhumby Ventures and Iberis Capital invest again, with growth capital from ORIX USA. The Durham company, whose API runs Tesco's and John Lewis's ad networks, has now raised over $100m.

  5. 5Funding news

    Mave emerges with $34m to run SecOps across existing security tools

    A $28m Series A led by Red Dot Capital Partners follows a $6m seed from Dell Technologies Capital and Emerge. The Israeli company says it already runs in more than 200 security operations centres.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy