Apple, Artificial Intelligence, Computing

Tech News Roundup: Apple’s Touchscreen Macs Land, OpenAI Finds 948 Ways to Root Linux, and a Patch Week You Shouldn’t Skip

Apple’s five new products are on shelves — and the touchscreen Macs are already backordered

Friday, November 6 was the biggest Apple launch day in years: five products hit stores at once — the OLED iPad mini with A20 Pro (from $699), the M6 iMac (from $1,499), the 14-inch MacBook Pro with M6 (from $1,999), and the 14-inch and 16-inch MacBook Pro with OLED touchscreens (from $2,899 and $3,399). The touchscreen models are Apple’s first touchscreen Macs, and demand is showing: most configurations were already shipping in 2–3 weeks by launch evening, with some slipping to late November or early December. The standard M6 machines, by contrast, were generally available for launch-day pickup. Next up: Apple’s HomeView smart home hub and an updated Apple TV 4K arrive Friday, November 13. (MacRumors)

OpenAI’s security pipeline found 948 ways to become root on Linux

On November 4, OpenAI published “A thousand fewer paths to root,” describing a prototype pipeline that audited about 2.8 million lines of the Linux kernel — roughly 7% of it — and produced 948 distinct local privilege-escalation vulnerabilities, each with a working exploit and a draft patch. The funnel: 2,308 candidate findings, 1,724 reproduced in test VMs, 1,169 working root exploits, consolidated to 948 unique bugs, plus 291 information-leak proofs of concept. Total API bill: about $1.21 million, or roughly $1,279 per bug. The important caveats: these are candidate patches for maintainer review, not shipped fixes — at the ten-day mark, 61 had been patched upstream and 43 more were in staging — and every number comes from OpenAI’s own report, with no CVE list published yet. The next day OpenAI named the engine GPT-6 Cyber, a security-tuned model rated Critical under its own Preparedness Framework, available only to a select group of approved customers for now.

Patch week: WordPress, Zyxel, and SonicWall all hit CISA’s exploited list

Three actively exploited vulnerabilities landed in CISA’s Known Exploited Vulnerabilities catalog between November 3 and 6, and if you run any of this gear, the homework is real. WordPress Core (CVE-2026-119977) is a race condition during core upgrades that lets an unauthenticated attacker execute code through predictable staging paths — the federal remediation deadline was November 6, and the fix is in WordPress 7.1.4, so make sure auto-updates are on. Zyxel GS1900 switches (CVE-2026-107441) have an out-of-bounds write giving LAN-based unauthenticated command execution — and it survives the June patch, which fixed a different bug. SonicWall SonicOS SSLVPN (CVE-2026-19868), added November 6 with a November 20 deadline, can let an attacker holding credentials for a different login method bypass SAML checks, including SAML-enforced MFA. Apple WebKit also joined the list (CVE-2024-27834, a 2024 bug already fixed in May 2024 — just make sure you’re current). (ZeroHunt tracker, Apprised)

Claude Code’s “Don’t Ask Again” button leaked secrets into 1,122 public GitHub repos

This one stings because it’s a convenience feature doing exactly what it was designed to do. Security firm Apiiro reported November 5 that when you approve a Claude Code shell command with “Yes, and don’t ask again,” the full command — passwords and API keys included — is saved verbatim as an allow rule in the project’s .claude/settings.local.json. That file is meant to stay on your machine, but scanning public GitHub found 104,185 copies of it, and 1,122 of them (1.1%) contain at least one real secret — 1,379 distinct credentials, including 379 database passwords and 122 Supabase service-role keys. Counting git history, shared settings files, and saved agent transcripts, the total reaches 2,539 secrets across 1,994 repositories and 63 organizations. Worse, the usual scanners miss a fifth of them: gitleaks flagged 564 of the 1,122 files and TruffleHog 643. If you use Claude Code, search your repos for the file, git rm --cached it, add it to the repo’s own .gitignore, and rotate anything that might have been in a command you approved. Users have been reporting the behavior since August 2025; as of November 8 there’s no public reply from Anthropic.

Google buys Crusoe’s Wyoming site for a $17B data center, and the Anthropic IPO watch ticks on

Google is building its first Wyoming data center the hard way — by buying someone else’s. Crusoe said November 6 that Google has acquired its unfinished data center site in southeast Wyoming, a day after Google announced a $17 billion investment in the campus, to be powered by fuel cells and gas generation with carbon capture. Meanwhile, the Anthropic IPO watch continues: The Information reports the roadshow starts next week, with the company aiming to list before Thanksgiving — still no confirmed date, so the watch stays open.

Gear mentioned

As an Amazon Associate I earn from qualifying purchases, which helps cover the cost of keeping this site online.