CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. New York also enacted restrictions on how AI chatbots can interact with minors. Meanwhile, a report on Epic raises a familiar but consequential question for health technology: who gets to connect to the data?

Ivanti Connect Secure flaws are under active attack

CISA has added CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog. CISA describes the first issue as missing authentication for a critical function, and the second as predictable generation of numbers or identifiers.

That designation matters because it is based on evidence that attackers are already exploiting the flaws. Separately, The Hacker News reported that attackers can chain three Ivanti Connect Secure flaws to obtain unauthenticated root access. Root access is the highest level of control on a system, and it is especially serious on an internet-facing access appliance that sits near the edge of an organization’s network.

Organizations running Ivanti Connect Secure should treat this as an immediate operational task: apply the relevant mitigation and investigate whether the appliance shows signs of compromise. Patching is essential, but it may not be enough if an attacker already gained control.

New York sets boundaries for chatbots used by minors

Governor Kathy Hochul signed New York’s S9051B into law on October 28. It takes effect on January 1, 2027, and restricts certain behavior by AI companions and chatbots when their users are under 18.

The law bars systems from presenting themselves as human or emotionally alive, claiming personal or authority relationships, encouraging secrecy or emotional dependency, or facilitating self-harm, substance use, eating disorders, or sexual content. The protections apply unless a provider has confirmed that the user is an adult.

That last condition makes age assurance central to the law’s practical effect. A provider cannot simply write rules for minors if it has no reliable way to know who is using the product. Product teams will need to consider chatbot behavior, moderation, and age-verification flows together. Reporting cited in the supplied material says civil penalties can reach $25,000 per violation.

Epic’s data connections are under scrutiny

A STAT investigation examines claims that electronic health-record company Epic uses its market power to limit some software developers’ access to patient-data connections. Developers told STAT that the restrictions can hinder competing health-tech products and the adoption of clinical AI tools. Epic says it provides more data connections than federal law requires.

This is a dispute about interoperability, the ability of different systems to exchange and use information. In health care, that is not a minor technical detail. A hospital’s records platform can determine whether outside tools can securely work with clinical data at all.

Epic’s position may be that it already exceeds its legal obligations. Developers’ concern, according to the investigation, is that the practical terms of access can still decide which products can compete. As more clinical software depends on access to patient records, the rules set by dominant platforms will shape what hospitals can buy and what patients may ultimately encounter.

Mistral releases large-model weights, with a cyber exception

Mistral has released downloadable weights for Mistral Large 4, a trillion-parameter mixture-of-experts model. A mixture-of-experts model does not use all of its parameters for every request; Mistral Large 4 activates roughly 49 billion parameters per request.

According to reporting from The Neuron, the multimodal model accepts text and images, offers three reasoning settings, supports a one-million-token context window, and can be self-hosted across eight GPUs. For organizations with sensitive code or data, downloadable weights create the option to evaluate and run a large model on their own infrastructure rather than sending every request to an external API.

Mistral did not make its stronger cyber-focused version equally available. The company kept it limited to vetted security partners after testing indicated it could increase real-world attacker capabilities. That split is a sensible acknowledgment that self-hosting and broad distribution are not purely technical choices. The same capabilities that could help defenders can also make misuse easier to scale.

Climate models may omit warming-driven emissions

A synthesis of prior research estimates that emissions from thawing permafrost, intensifying fires, warmer lakes and reservoirs, and wetlands could add between 0.2°C and 0.4°C of warming by 2100. The cited research says these feedback emissions are not fully included in models used for major United Nations climate assessments.

A separate analysis found that three regional feedback sources could shorten the time to sustained breaches of the 1.5°C and 2°C warming thresholds by as much as 25%. These are not emissions that can be treated as a fixed background figure. They are feedbacks: warming changes natural systems, and those changed systems release more greenhouse gases.

For governments and businesses using climate projections to set targets or plan infrastructure, omitted feedback emissions could affect the carbon budgets and timelines behind those decisions. The important point is not that every estimate is settled, but that these sources need to be measured and represented rather than left at the margin of the model.

Eating-disorder incidence rose, while clinicians flag new risks

A JAMA Psychiatry analysis estimated that annual incidence of anorexia nervosa and bulimia nervosa increased 71% worldwide between 1990 and 2023. The study covered 204 countries and territories, estimated that 18.1 million people were affected in 2023, and projected that 21.8 million people could have one of the two conditions by 2050.

Clinicians interviewed by MIT Technology Review raised concerns that social-media recommendation systems and misuse of GLP-1 weight-loss drugs may worsen risks. The global analysis itself did not establish the causes of the increase, and that distinction matters. The data describe a troubling trend; they do not prove that any one technology or treatment created it.

Still, the concerns have direct implications for prescribing and product design. Screening and monitoring for disordered-eating symptoms may be important for people using GLP-1 drugs, while social platforms face continuing questions about body-image content amplified by recommendation systems.

Tesco reportedly looks to move from VMware to Proxmox

Tesco is reportedly recruiting leadership for a migration from VMware to Proxmox, an open-source virtualization platform. One report says the retailer is targeting store systems for transition by the end of 2027.

The reporting connects the possible move to the end of support for perpetual licenses and rising prices. However, the supplied material does not independently establish the full scope, timetable, or rationale. That caveat is important: a major enterprise migration is far more than a license substitution.

If the project proceeds at the reported scale, it will be a useful case study for infrastructure teams reconsidering VMware dependence. Proxmox may be an appealing alternative, but organizations should not assume it is a drop-in replacement for their existing operating model.

A meteorite preserves a very early piece of Mars

NASA-funded researchers dated the Teghaza 001 meteorite, found in the Sahara in 2022, to more than 4.1 billion years ago. The nearly two-pound rock is one of the three oldest known Martian meteorites and contains an unusual combination of volcanic minerals.

Its mineralogy suggests that Mars’ early crust formed as magma cooled and was later altered by subsurface water, possibly in the planet’s southern highlands. That makes Teghaza 001 more than a rare artifact. It is an unusually old physical record that can help researchers narrow targets for orbital and surface studies of ancient Martian terrain.

Sources

  • The Hacker News
  • CISA
  • Supercharged With AI
  • The Neuron
  • Mario | Health Tech
  • The Spark from MIT Technology Review
  • The Download from MIT Technology Review
  • The Checkup from MIT Technology Review
  • ITPro Daily
  • Abhi from It's FOSS
  • NASA