Daily brief · Thursday, 29 October 2026
Gemini 4 Carbon, DHS data leak
AI
Google calls Gemini 4 Carbon its strongest model, ranking first on Artificial Analysis Intelligence Index v5.0 at 59, ahead of Claude Opus 5.5 and GPT-6 Astra. It scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. It follows Gemini 4 Argon, launched two weeks ago. Access starts with a subset of cyber defenders, widening to trusted partners through the Fairwind Program, and Google says it is taking part in the US government's voluntary pre-release testing.
blog.google, The Verge, Ars Technica, artificialanalysis.ai, HN
Security & Privacy
Distributed Denial of Secrets published an archive it calls Icepick, covering more than 41,000 DHS employees or contractors across the department and seven component agencies, including ICE and CBP. The records include email addresses, phone numbers, office addresses, references to internal systems and sensitive information on undercover and surveillance programs, last updated August 19, 2026. DDoSecrets says the data is from DHS's Okta login system and was obtained from a group calling itself the Department of Peace. Okta says it is unaware of any breach of its systems.
Last week two critical bugs in PHP, the language behind roughly 70% of websites, sent organizations scrambling to patch. Some took sites offline until the fixes were in. Wiz's CTO discusses the PHP2Shell flaws and what he calls the coming vulnpocalypse, saying the cleanup is far from over.
Policy & Society
Attorneys for 15 Minnesota residents facing federal conspiracy charges have obtained records they describe as a sweeping, possibly unconstitutional spying operation by ICE against left-wing social movements. The discovery material includes reports, audio transcripts, emails, intercepted Signal chats, photographs and database queries. The investigations ran under the names Project Whipple Shield and Operation Puppet Master, authorized by National Security Presidential Memorandum 7, which followed Charlie Kirk's assassination in September last year.
Big Tech
Microsoft reported Q1 revenue up 19% to $92.28B and Azure revenue up 48% to $33.17B, the first time it has disclosed Azure revenue in dollars. Capex was $45.2B, below its own $50B projection, and free cash flow was $18.6B. A filing shows $10B in revenue from OpenAI arrangements, nearly 11% of the quarter's total, with $7.2B in outstanding receivables from OpenAI.
Alphabet reported Q3 revenue up 25% to $127.58B, slightly under estimates, and Google Cloud revenue up 103% to $30.7B, above the $28.7B estimate. Free cash flow was negative $9.07B and capex was $51.36B, with the full-year capex forecast kept at $195B to $205B. Google ad revenue rose 11% to $82.01B and YouTube ads rose 9% to $11.2B, both below estimates. Shares fell more than 10%. Google also expanded AI Search ads globally.
The US Department of Justice has made inquiries about how Nvidia's $12.93 billion deal to buy Hugging Face affects AI competition, according to Reuters' sources. Antitrust enforcers continue to probe Nvidia's conduct more broadly.
On October 17, Meta suspended the No Kings Coalition's Instagram account while almost 3,000 events were under way, starting around 1:30pm ET. Meta first blamed excessive posting, then said software using Claude AI was reading profiles, posts and hashtags at four times the normal rate. The account was publicly visible again after about 90 minutes, but organisers could not publish until access was restored at 5:33pm. Meta admitted the suspension was wrong.
Hardware & Science
Apple's new MacBook Pro has an OLED display and touch input. The 14-inch starts at $2,899 and the 16-inch at $3,399. Fully specced, the price reaches $14,549. Ars Technica's hands-on says the display looks great but the machine is not as different from the previous model as expected.
Startups & Funding
AI coding startup Cognition is considering a new funding round before year's end, according to Business Insider's sources. It has received offers valuing it at $70B to $80B, up from the $48B valuation announced in September.
Cloud security startup Upwind raised a Series C at a $3.8B valuation. It had walked away from an acquisition offer from Datadog at the same price.
Developers & Open Source
Cursor released the Agent SDK, the framework it uses for its own managed agents Bugbot, Security Reviewer and Rollouts. Teams define agents in code and deploy them to Cursor infrastructure with agent-sdk deploy. Agents can respond to pull request events from GitHub, GitLab or Bitbucket, assess risk and route changes to the right team.
Show HN and Launch HN
Presenters and cohosts control the current page while everyone stays on the same slide, without sharing a screen. It also includes collaboration features.
A 3D CAD tool that runs locally in the browser and on Windows.
The author built a JavaScript engine by working on it every day for 950 days, and is asking for feedback.
Also today
The Seoul-based AI chip startup's valuation is up from $735M in 2025. South Korea's National Growth Fund contributed $280M.
Marvell is in advanced talks to buy data center optics maker Lumentum, valued at about $83B, according to Bloomberg's sources. A deal could be announced as soon as next week.
The cap runs through FY 2030. Oracle expects free cash flow to turn positive in H2 FY 2028 and top $30B in FY 2029. Shares rose more than 11%.
The new tools show companies what their AI spending is buying, ahead of a planned IPO.
Regulatory approval is in for Amazon Leo's acquisition of Globalstar, first announced in April.
A Lobsters post reports that Apple's git still trusts the compromised eMudhra certificates.
Gov. Kathy Hochul signed bills banning AI chatbots from using unsafe features for minors and requiring security features in internet-connected baby monitors.
The open-weight model transcribes 40 languages, translates 31 and labels up to eight speakers. It is first among open-weight models on the Hugging Face Open ASR Leaderboard for English.
Read from 81 items posted in the last day on Hacker News, Techmeme, TechCrunch, The Verge, Ars Technica, Lobsters and the YC blog.
Get it every morning
The daily brief at 00:45 UTC, the weekly on Monday. Free, and one click to stop.