This week’s most consequential stories are about systems that other systems depend on. The compromise of country-code domain registries is a sharp example: an organization can protect its own infrastructure and still be affected by a failure farther down the chain.

Elsewhere, AI tools are moving into health care and business reporting, researchers are making nuclear clocks work as experimental references, and ESA is approaching an asteroid system that humanity has already altered.

Registry breaches led to unauthorized certificates for Google domains

Google said attackers compromised the registries for the .gh, .sl, and .as country-code domains. The attackers then used that access to obtain unauthorized HTTPS certificates for several Google domains, according to The Hacker News.

Google said its own systems were not breached. That distinction matters, but it does not make the incident minor. The certificate system depends on a chain of organizations and technical controls. A compromise at a registry provider can therefore create consequences for domains that the registry operator does not directly own or operate.

An unauthorized certificate could support a convincing impersonation or interception attempt against users of an affected domain. This is a useful reminder for website operators: protecting the servers they run is necessary, but it is not the whole security boundary around their HTTPS identity. Trust in a domain also relies on outside providers doing their jobs correctly.

Public AnyDesk exploit puts Linux deployments under pressure

Researchers have released working exploit code for a pre-authentication remote-code-execution flaw in AnyDesk for Linux, The Hacker News reported. According to the report, an attacker can gain root access before a user approves a remote connection.

That combination is particularly serious. Remote-access tools are designed to reach machines from elsewhere, and root access gives an attacker broad control over a Linux system. The reported flaw removes the normal approval step that users might expect to provide protection.

The immediate task for organizations is practical rather than theoretical: identify AnyDesk installations on Linux, determine whether they are exposed or unpatched, and patch or disable affected instances quickly. Public exploit code reduces the effort required to turn a vulnerability report into an attack.

Everlywell offers AI mammogram risk assessments through telehealth

Everlywell plans to sell the Clairity Breast AI mammogram risk assessment directly to self-pay patients through an affiliated medical group. Mario | Health Tech reported that a provider order is required, after which a scan can be uploaded for analysis.

The service returns a low, intermediate, or high risk assessment expressed as a percentage. Clairity Breast AI had previously been available at only two imaging centers in two states, according to the report.

The interesting part is the distribution model. Instead of waiting for a hospital or imaging center to adopt the software, patients may be able to access the assessment through a telehealth route. That could widen availability, but it also puts more weight on how the results are explained and used. A percentage-based assessment can sound precise, so patients and providers need a clear understanding of what it represents.

Thorium-229 nuclear clocks become working research systems

Researchers have realized optical nuclear clocks using thorium-229. According to Nature, the teams stabilized lasers to the isotope’s 148-nanometer nuclear excitation using a rapid feedback loop based on absorption spectroscopy.

Nature describes thorium-229:CaF2 as a stable solid-state platform for compact nuclear clocks and nuclear quantum sensors. That is a dense description, but the important point is straightforward: the researchers have created a working reference based on a nuclear transition, rather than only describing the idea in theory.

This is still a research system, not a near-term commercial product. Its immediate value is as a new platform for precision metrology, the science of measurement, and for tests of fundamental physics. More compact and precise clocks could eventually have uses in navigation, communications, and scientific measurement, but those applications should not be treated as products waiting just around the corner.

Anthropic lowers Haiku pricing for short-context API work

Anthropic has announced Claude Haiku 5.5, a lower-cost model aimed at high-volume work such as support automation, document processing, and coding assistance. For prompts of up to 100,000 input tokens, Anthropic lists pricing of $0.10 per million input tokens and $0.50 per million output tokens.

That compares with $1 per million input tokens and $5 per million output tokens for Haiku 4.5, according to Supercharged With AI. The company also reports benchmark improvements, although those claims need validation in real workloads.

The price change is meaningful for teams making many short-context calls. A smaller model can be a sensible fit for routine steps in a larger agent workflow, where using an expensive model for every classification, extraction, or formatting task would be wasteful. Still, the headline rates are only one part of a migration decision. Teams should test reliability, latency, actual token consumption, and pricing outside the short-context range before switching production workloads.

Claude Dashboards connects AI analysis to live business data

Anthropic has introduced beta Claude Dashboards, which can connect to systems including Salesforce and Snowflake and generate charts that update with underlying data. The Neuron also reported that Anthropic introduced Motion, a tool for converting reports and charts into editable code-based animations.

At the same time, Claude Docs, Slides, and Design have left beta and are available on free plans. The dashboard feature is the more consequential release for businesses, because it moves AI assistance closer to operational reporting rather than one-off writing and research tasks.

That convenience creates a governance requirement. A generated chart is only as useful as its metric definition, source data, and underlying query. Organizations should make those details inspectable before people use AI-generated dashboards to make decisions. A polished chart can create false confidence when a measure is incomplete or defined differently from what its audience assumes.

ESA’s Hera closes in on the Didymos asteroid system

ESA’s Hera spacecraft is preparing for a 93-minute continuous braking burn on October 15 as it approaches the Didymos binary asteroid system. ESA says the maneuver will bring Hera close to the orbital velocity of Didymos and Dimorphos, allowing it to study the pair at close range.

Dimorphos is especially notable because its orbit was previously shifted by human action. Hera’s work will provide the first detailed follow-up examination of an asteroid deliberately deflected by a spacecraft.

That makes Hera more than a routine asteroid visit. The mission can add evidence about what changed in the system and help support future planetary-defense work. Deflecting an asteroid is an impressive achievement; understanding the detailed result is the part that turns a demonstration into a stronger technical foundation.

JetBrains releases Mellum2.1 under Apache 2.0

JetBrains has released Mellum2.1, a 12-billion-parameter mixture-of-experts coding model with 2.5 billion active parameters per token. The model is available under the permissive Apache 2.0 license, according to Marktechpost AI.

JetBrains says reinforcement learning in real software environments increased its SWE-bench Verified score from 2.0 for Mellum2 to 47.0 for Mellum2.1, without an architectural change. Those figures come from the company’s own shared evaluation pipeline, and the model trails Qwen3.5-9B on several tests.

The release is useful for developers who want locally run or self-hosted coding agents. The claimed evaluation jump is also a reminder that post-training can substantially change a model’s practical behavior. But it is a claim that needs independent testing, particularly because coding benchmarks do not fully capture how a model behaves inside a real repository, with real tools and real consequences for a codebase.

Google’s Android identity rules draw hobbyist objections

Google is reportedly requiring some Android developers to pay a $25 registration fee and complete identity verification before distributing apps more widely. Hobbyist developers have objected to the administrative burden, the government-ID requirement, and concerns that personal information could appear alongside their apps, according to Cybernews.

Google says the changes are meant to make it harder for malware and fraud operators to return under new identities. The rationale is understandable: repeat malicious publishers benefit when creating a new identity is cheap and simple.

But the cost is not only the $25 fee. Small developers can be sensitive to paperwork, identity checks, and the possibility of personal details being associated with their software. This is a familiar tension in platform policy. Stronger accountability can deter abuse, yet it can also make an open distribution model less welcoming for people who build small, free, or experimental apps.

Sources

  • The Hacker News
  • Mario | Health Tech
  • Nature
  • Supercharged With AI
  • The Neuron
  • ESA
  • Marktechpost AI
  • Cybernews