Pennsylvania’s governor signs a law requiring advertising disclosures

Pennsylvania Governor Josh Shapiro signs advertising disclosure law

Pennsylvania Governor Josh Shapiro signed an advertising disclosure law with exceptions for parody, satire, commentary, criticism and evidently fictional content. The Verge reports that the requirement applies regardless of where an ad was created, bringing qualifying advertisements made elsewhere for Pennsylvania audiences within its reach.

UK government commits £100 million to biosecurity lab

The UK government has established a biosecurity lab with a £100 million funding commitment. OpenAI and Anthropic have separately pledged £100 million each in model credits to support its planned research into detecting biological threats and developing vaccines and treatments.

Etsy announces ban on AI-generated recipes and craft patterns

Etsy has announced restrictions on AI-created instructions that buyers follow to cook or make craft items. Sellers will have to demonstrate actual results, while AI-generated art will remain permitted when sellers play a clear creative role and disclose the process.

CyberCartel uses AI to attack 400-plus institutions, researchers say

Straiker reports that CyberCartel used AI agents in attacks on more than 400 Latin American institutions, including access to individuals’ bank accounts. SpaceX was working to restrict the group’s access, while Straiker was seeking contact with another provider, Moonshot AI.

Updated

Arista patches exploited VeloCloud Orchestrator flaw

Arista has issued fixes for an actively exploited flaw in on-premises VeloCloud Orchestrator. The US cybersecurity agency added it to its exploited-vulnerability catalog on 23 October, with federal civilian agencies advised to apply fixes by 26 October.

Updated

Alabama tightens data-center rules but keeps default approval

Alabama’s utility regulator has tightened data-center contract disclosures while retaining approval through inaction after 90 days. The commission’s final order requires complete agency review but leaves some cost calculations confidential. Alabama Power’s tariff sets November 23 for the new process to begin.

Updated

Collabora warns of exploited flaw in built-in Nextcloud app

Collabora warns that attackers exploited its optional built-in Nextcloud app. The US cybersecurity agency added the flaw to its exploited-vulnerability catalog on 23 October, according to The Hacker News, which reports a recommendation for federal civilian executive agencies to apply fixes by 26 October.

Updated

Node.js patches Brotli flaw and blocks compromised certificate keys

Node.js has patched its Brotli decoder and blocked eight certificate keys reported compromised. Fixes are also available for Bun, Python packages, Envoy, Istio and Debian installations that decode untrusted Brotli. Maintainers need to update each affected copy, rebuild container images and restart services.

Updated

LiteLLM 1.107.0 carries credential stealer and backdoor

LiteLLM 1.107.0 distributed credential-stealing malware and a backdoor on 21 October. The maintainers trace the release takeover to an unrevoked master key exposed on 27 May and say they are revoking tokens across internal systems and vendor platforms.

Navigate360 acknowledges crime-tip system breach

Navigate360 has confirmed data theft seven months after saying it was investigating whether an incident had occurred. Officials in Nevada and Canada say the company supplied only partial information despite repeated requests, while Ontario police forces have suspended the service.

Researchers link AI-assisted intrusions to ransomware affiliates

SOCRadar’s findings linked live AI-assisted intrusions to ransomware affiliates, The Hacker News reported. The operation was estimated to have targeted 62 organizations, with four appearing on ransomware leak sites as operators sought payment over stolen data.

Kaspersky reports BlackX attacks on patched Windows systems

Kaspersky reports BlackX intrusions at diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The investigation points administrators beyond Windows updates to separate Secure Boot revocations, which block vulnerable startup programs from loading.