Midday Tech Digest | October 11, 2026 | GhostAction campaign hits hundreds of GitHub repos

Midday Tech Digest — Sunday, October 11, 2026. Coverage: October 11, six a.m. to eleven a.m. Pacific. A thin Sunday-morning window: the feed carried mostly commentary, with no in-window chips, robotics, space, quantum, or consumer-hardware news. This edition covers the freshest verified material not covered by prior editions, published October 9–11, plus one in-window feed item, with caveats stated per story. 1. GhostAction returns: credential-stealing GitHub Actions workflows Socket and StepSecurity disclosed a new burst of the GhostAction supply-chain campaign on October 8–9. Compromised maintainer accounts pushed a malicious security-audit.yml workflow into hundreds of repositories (Socket counts 346 in the October 8 burst; StepSecurity counts 345), sweeping Actions secrets and full git history for 13 credential patterns. Socket's October 9 update put the wider wave at more than 500 accounts and tens of thousands of repositories since October 7. As of October 9, no malicious package releases using stolen credentials had been observed. Socket: https://socket.dev/blog/ghostaction-c... The Hacker News: http://thehackernews.com/2026/10/cred... 2. Nvidia in talks to invest further in, or acquire, Reflection AI (unconfirmed) The Financial Times reported October 10 that Nvidia is in early talks to deepen its investment in open-weights startup Reflection AI or acquire it; FT put Nvidia's existing investment at $800 million. Reuters relayed the report and could not immediately verify it; Reflection declined to comment and Nvidia did not immediately respond. This is a talks report, not an announced deal. Reuters: https://www.reuters.com/business/nvid... 3. Berkeley study: brief AI help eroded persistence once removed A study presented at the Conference on Language Modeling and reported by UC Berkeley News on October 9 ran three randomized trials (1,222 participants): the group that used ChatGPT started more accurate, but after the tool was removed at problem 12, accuracy fell sharply and skipping rose, while the unaided group held steady. The paper began as an April preprint revised October 3; it measures short-task performance after brief use, not permanent harm. Berkeley News: https://news.berkeley.edu/2026/10/09/... 4. EU tech chief: the AI Act already covers rogue agents Reuters reported October 9 that European Commission VP Henna Virkkunen said existing EU rules are more than capable of tackling rogue AI agents. In late August the Commission sent information requests to more than 30 AI companies on safety and security measures; such requests can lead to investigations and fines of up to 7% of global annual turnover. Reuters (syndication): https://www.wysl1040.com/eu-tech-chie... 5. Petra Power: solid-oxide fuel cells for data centers and defense TechCrunch profiled Petra Power on October 10: founded 2017, about 15 people, nearly $9 million in Defense Department contracts, targeting a first data-center deployment in 2028 and full-scale production in 2029. Caveats: no firm hyperscaler agreement, and its vehicle auxiliary-power product has not deployed on a live vehicle. TechCrunch: https://techcrunch.com/2026/10/10/pet... 6. NASA: Cygnus XL scheduled to burn up on re-entry today NASA's station blog reported the Northrop Grumman Cygnus XL (CRS-24) was released from the space station on October 9 loaded with disposal cargo, and would deorbit on Sunday, October 11 in a destructive re-entry, with no NASA coverage of the deorbit. As of this edition's cutoff, NASA had published no confirmation of the completed deorbit; the verified fact is the announced schedule. NASA: https://www.nasa.gov/blogs/spacestati... 7. MiniMax H3 "Turbo" is community tooling, not an official release A feed item presented a "MiniMax H3 Turbo" model on Hugging Face. H3 is MiniMax's official open-weights video model (early August 2026); the Turbo variants are community distilled LoRA adapters, principally from the LightX2V team, that cut sampling steps to 4 or 8 and require the original H3 model. LightX2V Turbo SLA (Hugging Face): https://huggingface.co/lightx2v/Minim...