Daily Digest – 15 October 2026
Morning from Oslo. Today's biggest story is Microsoft's record Patch Tuesday, with more fixes in one month than in all of 2025. Closer to home, an AI agent reportedly deleted a whole season of a Swedish TV show, and Hacker News spent the day arguing about passkeys.
Tech sector
Microsoft ships a record 1,413 fixes in one Patch Tuesday
October's patch drop covers 1,413 CVEs, more than Microsoft fixed in all of 2025. One Windows shell bug that bypasses Mark of the Web (CVE-2026-96951) is already being exploited. SecurityWeek largely blames AI-driven bug hunting for the surge.
Why it matters: Patch fatigue is now a scaling problem. If your team runs Windows fleets or SharePoint, automated patch rollout and good SBOM hygiene are now essential.
Source: SecurityWeek · 14 Oct
ASML posts a record quarter and can't build machines fast enough
The Dutch lithography maker reported €11.7B in Q3 sales and €5.0B in net income, and guided €14.2–15.2B for Q4. Some customers already want to book capacity for 2029–2030, and ASML expects supply in 2027–28 to fall short.
Why it matters: Europe's most important tech company is the clearest sign that the AI spending cycle is still running hot. That keeps GPU and cloud prices high for the next two years, and you will see it in your inference bill.
Source: ASML investor release · 14 Oct
Google quietly links your phone number to every signed-in Android account
An on-by-default "Phone number verification" setting attaches your number to each Google account on the device, work and personal alike. You can switch it off in Settings → Google → All services, and then remove the number from each account manually.
Why it matters: Linking personal and work identities sits awkwardly with GDPR purpose limitation, and European data protection authorities like Datatilsynet may start asking questions. Check your work phone today.
Source: Android Authority · 14 Oct
Yandex knocked offline, and Cloudflare data shows the bad bots just moved
After strikes on Yandex facilities, its search and cloud traffic collapsed and was still at 85% of normal on 14 Oct. Cloudflare saw malicious bot campaigns move to other Russian hosts with identical fingerprints within a day.
Why it matters: Blocklists based on IPs and ASNs age fast. If your WAF rules depend on blocking a whole cloud provider, this is a good case for fingerprint-based detection instead.
Source: Cloudflare blog · 14 Oct
AI agents
An AI agent reportedly wiped a whole season of TV4's "The Challenge"
Sweden's TV4 pushed the reality show to 2027 after edited footage vanished. Aftonbladet says an AI agent deleted hundreds of days of editing work. TV4 only confirms a "technical failure".
Why it matters: This is a very real Nordic case of an agent with delete rights and no backups. Give agents the least privilege they need, and use soft-delete on anything they can touch.
Source: Sweden Herald (TT / Aftonbladet) · 14 Oct
Security pros say "rogue AI" incidents come down to missing sandboxes
CSO Online asked security experts about the recent run of AI-agent hacking reports across several frontier labs. Their verdict is that skipped basics, like sandboxing, egress controls and monitoring, did more harm than any machine intent.
Why it matters: This makes agent safety plain ops work that most teams already know how to do. EU AI Act auditors are likely to see it the same way.
Source: CSO Online · 14 Oct · HN discussion (513 comments)
Linus Torvalds posts his first LLM-assisted kernel patch series
The ten-patch series speeds up folio lookups with RCU tricks and shows an order-of-magnitude gain on a read-heavy benchmark. Reviewers have already found a race condition, so it needs more work.
Why it matters: The most sceptical maintainer in open source now uses AI for real work, and human review still caught the subtle bug. That is the realistic case for AI pair programming.
Source: LWN.net · 14 Oct · HN discussion
Hacker News buzz
"Passkeys are not a trap"
Scott Helme argues that the lock-in fears around passkeys are overblown and that their phishing resistance is worth it. It was the most-discussed thread of the day.
What commenters argued about: One side praised the phishing resistance and smooth Apple and Google UX. The other feared vendor lock-in and that attestation could one day limit logins to "approved" devices.
Why it matters: Norway already lives with BankID and MinID. Adding passkeys to your own app's login is an easy UX and security win, as long as you offer export and a fallback.
575 points · 725 comments · HN discussion
How Amazon pushes up prices all across the internet
The piece argues that Amazon's price-parity pressure and high seller fees raise prices even on other sites.
What commenters argued about: Some saw proof that antitrust needs teeth, while others said people should just shop elsewhere. A long side thread fought over Temu and AliExpress quality.
Why it matters: Amazon's footprint in the Nordics is still small. Building for Komplett, Elkjøp or Shopify-based stores means a different pricing and marketplace model from the US playbook.
796 points · 625 comments · HN discussion
"Anthropic's Scion is heavily inspired by Mononoke"
A former Meta engineer says Anthropic's new source control system mirrors Meta's Mononoke design without naming it. The author also worries that engineering in the LLM era will reuse designs without credit.
What commenters argued about: Plagiarism or normal inspiration. Defenders pointed out that Anthropic did cite Sapling as prior art. Critics said the matching data model deserved explicit credit.
Why it matters: Monorepo tooling is coming back into fashion as agents generate more code. Credit and prior art are a live culture issue for every engineering blog.