Exploited GitLab bug, Mistral opens Le Chonk, AWS bets $220B on AI
7 stories~2 min read
- Top storySecurity
CISA says attackers are exploiting a CVSS 10 GitLab flaw in CI/CD regex parsing (opens in a new tab)
CISA added CVE-2026-97229 to its exploited list on 29 October, 17 days after GitLab's 12 October fix. A crafted regex in a CI config can run code on unpatched self-managed GitLab, so upgrade now and check whether open sign-ups let strangers create projects.
- Languages
Go team warns Go 1.24+ servers are exposed to Linux TCP bug CVE-2026-98432 (opens in a new tab)
Go programs on Linux listen with Multipath TCP by default, the setup Anthropic used for a remote root exploit of this 9.8 kernel bug. Patch the kernel; GODEBUG=multipathtcp=0 is only a stopgap while Ubuntu and RHEL fixes are pending.
- AI
Mistral releases open weights for Mistral Large 4, its 1-trillion-parameter model (opens in a new tab)
The Paris lab put Le Chonk (49B active parameters per token, 1M-token context) on Hugging Face after three more weeks of training. Its modified-MIT licence requires a separate commercial licence for Model-as-a-Service businesses, so check before building on it.
- Cloud
AWS grows 39% to a $184B run rate as Amazon keeps 2026 capex at about $220B (opens in a new tab)
Amazon says AWS revenue hit $46B in Q3, up 39.3% and its fastest growth in nearly five years. It still expects about $220B of 2026 capex and meaningfully more in 2027, so expect more AI capacity and pressure to prove it pays.
- Security
CrowdStrike: China-linked hackers ran DeepSeek-powered agents against 200+ organisations (opens in a new tab)
CrowdStrike says Vapor Panda used its ARTEX agent framework against more than 200 organisations from 17 October, confirming intrusions at nine, where it planted the BLOODALCHEMY backdoor. Attackers can now probe at machine speed, so patch exposed systems fast.
- Security
Binance links a record $6.3B theft to a DevOps engineer's compromised laptop (opens in a new tab)
Binance says the laptop gave an attacker access to a service container; TRM Labs says about $6.36B left Binance wallets on ten chains, mostly in 20 minutes, and blames North Korea's TraderTraitor. Lock down engineer machines and production access paths.
- Business
Cohere opens Series E of up to C$7B, with Canada's government and Nvidia investing (opens in a new tab)
The Toronto AI company targets a C$35.7B valuation, led by Germany's Schwarz Group, and pitches itself as a sovereign alternative to US and Chinese labs. Governments are now paying directly for local AI suppliers.
