Monday, 9 November 2026
A car-platform exploit chain; GCP generator failure behind a cable fault; OT's hidden remote-access paths
Today's Lead
Engineeringshubs.io
Unlocking any car from X brand in most of the world
Security researchers Shubham Shah and Sam Curry found a chain of weaknesses in an unnamed automaker's connected car platform. The chain let them send remote commands, such as unlocking doors, to cars they did not own. A license plate could be converted to a vehicle identification number (VIN). An exposed administrator tool, hardcoded credentials, and a web application firewall (WAF) bypass gave them administrator access. The researchers tested only cars they owned or had permission to access. The post does not describe a vendor response or fixes.
Engineering
MailRoute
Outlook.com Is Quietly Rejecting Email From Domains Without DMARC
Since November 5, 2026, Outlook.com rejects some email from domains without a domain-based message authentication, reporting and conformance (DMARC) record. Microsoft did not announce this change. Rejected messages show error 550 5.7.1, even for low-volume senders. The fix is to add a text (TXT) record named _dmarc with the value v=DMARC1; p=none. DMARC passes only when Sender Policy Framework (SPF) or DomainKeys Identified Mail (DKIM) passes for the From domain. The article later recommends p=reject, which tells receivers to refuse forged mail.
Aphyr
RIP, Harvest
Bending Spoons bought Harvest, an invoice and time software service, in 2025. The author's monthly cost rose from $13.32 to $133.98 after a move to an enterprise plan. Harvest now uses a large language model (LLM) to write replies to customer support emails.
tisiphone.net (Lesley Carhart)
Let's Talk About Why all This OT Stuff is Connected
Operational technology (OT) systems, such as water pumps and power grid equipment, are networked for sound business reasons. Lesley Carhart says these links grew from many reasonable decisions made over 15 to 20 years, not from incompetence. Vendors adopted Windows interfaces and commercial Ethernet to cut costs, which made the systems easier for attackers to find. Carhart often finds five to seven hidden remote access paths beyond the documented demilitarised zone. She argues that the response needs better controls and empathy for under-resourced operators.
LeadDev
Stop measuring developer productivity
Sandeep Khandelwal argues that teams should stop using output metrics to judge developer productivity. Metrics such as commits, pull requests, and deployment frequency miss the time that developers lose to friction. Friction includes slow build pipelines, flaky tests, and poor error messages. Leaders should estimate the cost of friction and remove it. Using artificial intelligence (AI) to write code does not speed up delivery if the pipeline stays slow. The article says the best way to improve productivity is to stop making developers wait.
Humanities
Aeon
Historical ideas of equality help us imagine an equal world
Political theorist Teresa Bejan says the word equality has many meanings, and these meanings now divide people. Ancient Greek, Roman, and Christian thinkers used equality to mean evenness, not identical sameness. Bejan argues that equality depends on institutions, such as jury service, where people act as peers.
JSTOR Daily
Why Ancient Doctors Prescribed Disgusting Remedies
Ancient Greek and Roman doctors used waste and other disgusting substances as medicine. Classicist W. V. Harris lists animal and human excrement, urine, blood, and crushed beetles among these remedies. Some doctors used these substances often, some rarely, and some not at all. Harris argues that the shock made the remedies seem powerful. These remedies lasted because no one could prove that they were useless.