Payments firm Block shows Dessa, a voice AI model it says runs on a MacBook Pro

The Verge reports that Block has unveiled Dessa, which it calls a "true speech-to-speech" AI model. Block says Dessa was trained on "nothing but human conversation" and runs locally on a MacBook Pro with an M4 Max chip or better. TechCrunch's reviewer says the model sounds eerily human.

Coding app Replit reportedly moved most AI spending to OpenAI after a 30%+ discount

The Information reports, citing a source, that Replit recently moved most of its AI spending from Anthropic to OpenAI. According to the report, OpenAI gave a discount of more than 30% in a deal worth over $100 million a year, after Anthropic ended its own discount. The Information frames it as a sign that OpenAI's push to undercut Anthropic on price is working.

OpenAI lets vetted security partners use its hacking-capable AI to find bugs

Forbes looks at OpenAI's Project Daybreak. It lets vetted partners use OpenAI's top hacking models, including the latest GPT model, to find and fix vulnerabilities. Forbes says the program helped uncover this week's php2shell flaws in PHP.

Grocery delivery app Instacart reportedly held sale talks with DoorDash and Uber

The Information reports that Instacart has hired an investment bank to weigh its options and has held acquisition talks with DoorDash. Bloomberg reports Instacart also talked to Uber, which reportedly walked away. Instacart is worth more than $13 billion on the stock market. Its shares rose more than 9.2% on Friday after the reports. Bloomberg says the talks are early and may not lead to a sale. Instacart declined to comment.

Apollo economist says AI has not yet paid off for US companies outside tech

Torsten Slok of investment firm Apollo Global Management writes that, despite large investments, AI has delivered no financial payoff to US companies outside the tech sector. He says AI is now seen as a cost that hurts profit margins, while venture-backed firms keep spending more on AI usage. The post drew wide discussion on Hacker News.

LattePanda launches Sigma 2, a single-board computer for running AI locally

LattePanda launched the Sigma 2, a 146 × 102 mm x86 board built around Intel's Core Ultra X7 358H chip with Arc B390 graphics. The company claims up to 180 TOPS of AI performance and up to 64 GB of memory. It says the board runs the Qwen3.6-35B-A3B model at around 30 tokens per second. It costs $2,599 in pre-sale through mid-November, then $2,799.

A new flaw in the PHP web language affects even fully patched servers

On October 23 the PHP project published an advisory for CVE-2026-115560, a flaw in PHP's session upload progress feature. It is related to the php2shell flaws disclosed this week. It affects fully patched releases, including 8.5.12, and will be fixed in PHP's next regular release. Cloudflare says its existing firewall rule blocks known attacks, but only on sites that use PHP's default upload progress field name.

Asus fixes a flaw that lets nearby attackers take over its Wi-Fi 7 routers

Asus released an urgent security update for its latest Wi-Fi 7 routers. The flaw affects models running the 3.0.0.6_102 firmware series. According to Asus's advisory, an attacker on an adjacent network can skip logging in and get full admin access to the router. The attacker has to be nearby on the local network, not anywhere on the internet.

Pennsylvania passes a law requiring labels on AI-generated ads

Pennsylvania Governor Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act on Thursday. It requires any ad, whether image, video, audio or text, that "has been significantly modified or generated by artificial intelligence" to carry a label.

Ukraine says SpaceX's military Starlink service works normally again

Ukraine says Starshield, its military Starlink system, was working normally again on Saturday morning, the Wall Street Journal reports. Speed restrictions imposed by Elon Musk's SpaceX had hampered Ukraine's drone forces since October 14. US officials said President Trump asked Musk to restore the service.

Everything else