LastWeekIn.Tech

This week straddled infrastructure consolidation, hard security failures, and AI's growing pains as both a target and a tool for attackers. Big money moves (Cloudflare buying Deno, Anthropic's contested IPO math) sat alongside quieter regulatory pushback on AI infrastructure and old-school supply-chain security nightmares. A reminder that the AI boom's plumbing is just as fragile as the hype suggests.

1. 1

   Number 1. Business Hacker News

   Cloudflare acquires Deno

   The entire Deno team, led by creator Ryan Dahl, is joining Cloudflare to integrate Deno's work with Cloudflare's Workers and Durable Objects platforms. Deno will receive bug fixes and security updates for one more year before development ends, though it will remain open source for community maintenance, while Deno Deploy will shut down in six months with migration support to Cloudflare Workers. The team plans to focus on a new project called celld, which builds on Cloudflare's Workers programming model to help developers create distributed applications with built-in scaling capabilities. JSR, Deno's package registry, will continue operating under Cloudflare's infrastructure.

   Why it matters Cloudflare swallowing Deno reshapes who controls the JavaScript runtime layer that much of the modern web depends on.

   Why it made the cut: 1373 points on Hacker News

2. 2

   Number 2. Security BleepingComputer

   Microsoft: Outdated Windows devices will stop receiving security updates

   Microsoft announced that devices running unsupported versions of Windows will lose access to Windows Update services after the company rotates its update certificates in May and June 2027. To maintain security updates, users and administrators must upgrade to a supported Windows version or install specific security updates before the certificate expiration dates, with different deadlines depending on the Windows version. Supported versions of Windows 11, Windows 10, and Windows Server already have replacement certificates installed, while devices on Windows Server Update Services (WSUS) are not affected by this change. Microsoft is advising IT administrators to identify older devices and create upgrade plans before May and June 2027 to ensure continued access to security updates.

   Why it matters Microsoft cutting off security updates for unsupported Windows versions will leave millions of devices exposed overnight.

   Why it made the cut: Covered by 2 outlets

3. 3

   Number 3. AI The Hacker News

   Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

   The npm package "tensorlake," a TypeScript SDK for Tensorlake applications, was compromised with malicious version 0.5.144 containing obfuscated malware as part of the ChainDrop/Shai-Hulud supply chain attack. The malware harvests credentials from npm tokens, GitHub tokens, AWS credentials, Kubernetes, SSH keys, and cryptocurrency wallets, while also establishing persistence and executing remotely supplied code. The attack propagates by enumerating packages associated with the victim's publishing identity and republishing compromised versions, with multiple data exfiltration channels including direct C2 communication and GitHub repositories as fallback mechanisms. Users who installed the malicious version are advised to remove it immediately and rotate their credentials.

   Why it matters A compromised npm package delivering a credential-stealing worm shows the AI software supply chain is now a prime attack vector.

   Why it made the cut: Covered by 2 outlets

4. 4

   Number 4. AI The Hacker News

   ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms

   Cybersecurity researchers at CrowdStrike disclosed a targeted campaign against South Korean financial institutions, including Shinhan Bank and Yegaram Savings Bank, that occurred from late September to early October 2026 using ARTEX, an open-source AI penetration testing tool developed in China. The unattributed threat actor, suspected to be a Chinese-speaking operator motivated by financial gain, leveraged ARTEX alongside large language models including DeepSeek v4.1-flash to exfiltrate data from multiple financial firms. In response to the misuse, ARTEX developer Autumn-27 announced the project would be converted to closed source with no future updates or maintenance support. Separately, ZenoX disclosed that a financially motivated Portuguese-speaking actor dubbed SCARLET LOOP is operating an AI-driven credential stuffing platform targeting Brazilian loyalty and gift card platforms, which has tested over 12 million credentials and successfully compromised accounts across nearly 4,000 domains.

   Why it matters Attackers using an AI pentesting tool to breach South Korean banks marks a concrete, documented case of AI-powered offense, not just theory.

   Why it made the cut: Covered by 2 outlets

5. 5

   Number 5. AI Hacker News

   Research Firm Calls Anthropic's IPO 'Unprecedented Test of Investor Gullibity'

   Research firm New Constructs released a report calling Anthropic's upcoming initial public offering "the most ridiculous IPO of 2026," valuing the artificial intelligence company at $150 billion compared to Wall Street's potential $2 trillion valuation. According to leaked prospectus information cited by Reuters, Anthropic generated $4.6 billion in revenue during 2025 while posting a $42 billion net loss, leading New Constructs to conclude the company lacks a viable business model amid competition from open-source AI alternatives. The firm argues that to justify a $2 trillion valuation, Anthropic would need to generate double the annual profits of Nvidia, the world's most valuable tech company. New Constructs founder David Trainer, known for bearish IPO calls including an accurate prediction about WeWork's failed 2019 offering, stated the IPO primarily benefits Wall Street backers seeking liquidity rather than public market investors.

   Why it matters A credible research firm publicly questioning Anthropic's trillion-dollar IPO math is a reality check on AI valuation mania before it hits public markets.

   Why it made the cut: 121 points on Hacker News · Covered by 2 outlets

6. 6

   Number 6. AI The Register

   Anthropic asks users to stop being mean to Claude

   Anthropic has updated its usage policy for Claude to prohibit "sustained and needless abusive or cruel behavior" toward the chatbot, effective November 12, alongside more significant restrictions on election interference, weapons development, and surveillance. The company tightened rules against deceptive influence campaigns after observing state media outlets and commercial organizations using Claude to create fake accounts and fabricated news, while clarifying that its weapons ban extends to software and components for armed drones and autonomous vehicles. Anthropic also prohibited using Claude to recommend targets for police investigation or to develop surveillance tools, and introduced requirements for human monitoring when Claude connects to physical equipment that could cause injury. The policy updates are part of a broader security initiative that includes free vulnerability scanning for open source projects and partnerships to help critical infrastructure operators protect against cyberattacks.

   Why it matters Anthropic policing user politeness toward its chatbot, buried next to weapons and surveillance rules, says something odd about where AI governance priorities are landing.

   Why it made the cut: 54 points on Hacker News · Covered by 2 outlets

7. 7

   Number 7. Security BleepingComputer

   Citrix warns admins to patch new NetScaler RCE flaw immediately

   Citrix has issued an urgent warning for IT administrators to patch a critical vulnerability tracked as CVE-2026-107406 affecting NetScaler ADC and NetScaler Gateway appliances that could allow attackers to execute remote code or cause denial-of-service crashes. The flaw affects only systems configured as SAML Identity Providers or Service Providers, and Citrix has provided specific patched versions for customers to upgrade to across multiple product lines. Shadowserver has identified over 21,000 exposed NetScaler devices on the internet, though the exact number with vulnerable configurations remains unknown. While Citrix has not detected active exploitation of this vulnerability, the company has warned that multiple other NetScaler flaws have been actively exploited by attackers since the start of the year, with CISA tracking 27 actively exploited Citrix vulnerabilities since November 2021.

   Why it made the cut: Covered by 2 outlets