REMINDER: On Tuesday, November 17, 2026, around 2:20 p.m. ET, FEMA and @FCC will conduct a nationwide test of the Emergency Alert System (EAS). The test will air on radio and TV only and will not be sent to mobile phones. No action is needed from the public.

Early Neuralink speech restoration data: We are enabling speech to text and voice at conversational rates in participants with ALS. One participant achieved 75 WPM at 5.8% WER on a 125k-word vocabulary in their first week.

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.

We launched OSS Scanner, which gives critical open source projects free, periodic vulnerability scans from our strongest models. Each finding includes a proof-of-concept, and a patch where possible.

‼️ UPDATE - Tailscale confirms the Tailworm SSH flaws are real. Its new investigation page says most of what it found is privilege escalation and calls the issues “serious.” Fix targeted within 24 hours — no CVE or patched version out yet. Mitigate now: → Set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service and restart → Tighten SSH access rules to the users/devices that need them Read: