What's happening in the world of servers, security, Québec law, AI and the connected home, explained simply, with at least two recognized sources for every entry.
Since November 6, 2026, two new articles have been added to the DRAK Infinity Articles, in French and in English. The first explains what the studies actually say about automatic appointment reminders: how much they help, why a reminder that says why the appointment matters works better than one that only says when, and what a missed appointment really costs a small practice.
The second compares three automation tools (Make, Zapier and n8n, pieces of software that connect your tools to one another, for example your calendar and your email) on what matters for a clinic, a salon or a self-employed worker in Quebec: the real price, where your data goes, and what connects to the tools you already use.
Both articles read without any prior technical knowledge and point to the Automation page, for anyone who wants to see how this applies at home.
What this means for you: Before choosing a tool or promising an automatic reminder to your clients, you can read what the studies and the real prices say, rather than relying only on what the provider claims.
Automation is live: your appointments, emails and reminders, on their own
Since November 6, DRAK Infinity has offered a second service to practitioners and small businesses in Montréal: Automation. You keep your booking tool, your calendar and the way you talk to your clients; we connect it all so the welcome email, the day-before reminder with its “I confirm” button, the alert if no one confirms, the after-visit message and the payment follow-up go out on their own.
Three packs: Start, one automation from $490 CAD; Client journey, the full journey at $2,490 CAD; Monitoring and fixes, $129 CAD a month, no commitment. Indicative prices, before taxes; a paid automation tool is required (Make, n8n or Zapier, from $11 to $25 USD a month depending on the tool), in your own name.
The page explains everything without jargon, with a two-minute video, a comparison table and two articles for further reading. The site menu was also shortened: Projects, News and Articles are now grouped under “What’s new”. The first meeting is free, by video call or at your place in Montréal and the surrounding area.
What this means for you: If you still send your reminders manually, take a look at the Automation page or bring it up at the free, no-commitment Discovery meeting.
DRAK Infinity’s new tools now show themselves in video
Since late October 2026, the DRAK Infinity website shows its products in video instead of in text alone. Two short videos, in French and in English, show the Serveur maison home server actually running, right on the homepage.
Another thirteen-second video shows the Facturier en ligne online invoicing tool, from creating an invoice to getting it paid.
The Maison 3D connectée page also gets a demonstration you can try yourself: you click on glowing points to see, in a 3D model of the house, how each device changes state.
What this means for you: You can see the products working before you even ask a question, right on the site, with no appointment or in-person demonstration needed.
During October 2026, security flaws were fixed in PHP and in Node.js, two tools that run a large share of the Internet.
These fixes add to others already published this year, like the ones for free programming tools that were booby-trapped in August in public catalogs where programmers go looking for them.
Meanwhile, some online services reserve the right to use what you hand them to train their artificial intelligence. My answer isn’t to cut you off from the Internet, it’s to keep your data at home.
What this means for you: Your backups need to exist somewhere other than with the provider, on a device that belongs to you.
On September 22, 2024, the final stage of Law 25 took effect in Québec, two years after its gradual rollout began.
Two years later, in September 2026, this law, which protects personal information (meaning anything about you that can identify you), still applies to every private business, even small ones.
A business must name a person responsible for that protection, keep a list of incidents, such as a data theft, and clearly ask people’s consent before collecting their information.
The Commission d’accès à l’information, the body that oversees the law, can itself impose a monetary penalty on a business at fault, without going through a court.
What this means for you: If your business still hasn’t named someone responsible for protecting personal information, or kept a list of incidents, that’s not a formality you can keep putting off.
Synology fixed, on September 18, 2026, two very serious flaws, rated 9.8 out of 10 (close to the highest score on the usual severity scale), in DSM, the software that runs its network drives: boxes that keep your files and backups at home or at the office.
One of these flaws affected how the device checks who has the right to connect, and could let someone, from a distance, read or write files without permission, or even crash the device; the other affected a similar defect in how the device processes the data it receives.
The only way to protect yourself was to install the update: no other way around the problem existed in the meantime. Singapore’s cybersecurity agency relayed the warning on September 23, 2026, recommending an immediate update of the affected devices.
What this means for you: A network drive that’s never updated keeps accumulating known flaws; regularly check its admin interface to make sure no critical update is waiting to be installed.
TP-Link released a fix in August 2026 for about twenty models of connected plugs, power strips, and switches in its Kasa line.
The flaw it fixed was rated very serious, 8.7 out of 10 on a severity scale that runs from 0 to 10: a device on the same Wi-Fi network could impersonate another one and change the state of a plug, or make it unusable.
That same month, a notice published on August 10, 2026 announced a fix for the Samsung SmartThings app, for a flaw affecting permissions in versions before 1.8.47.24 that could let someone read sensitive information they had no right to see.
What this means for you: A connected plug or switch that never receives a firmware update stays vulnerable indefinitely; check in the manufacturer’s app whether an update is available for your devices.
A computer worm spreads through JavaScript libraries
On August 4, 2026, researchers at the company Elastic discovered malicious software nicknamed “ChainDrop,” a new version of a computer worm (a program that copies itself from one place to another) already seen the year before under the name Shai-Hulud.
This worm infected widely used JavaScript building blocks, including keyv and cacheable, by stealing the passwords or access keys of the people responsible for them in order to publish booby-trapped versions in their place.
According to Elastic, more than 400 distinct building blocks were affected; other sources put the total at more than 1,300.
These building blocks are invisible pieces used by a very large number of websites and programs, a bit like spare parts nobody ever sees but that everyone depends on.
What this means for you: You never see them, but the sites and tools you use depend on thousands of small software building blocks like these; a serious provider monitors and updates these dependencies instead of installing them once and forgetting about them.
On July 29, 2026, the people behind Node.js, a tool that runs a large share of websites and applications on the Internet, published eleven security fixes, also called patches, for the versions of that tool still being maintained.
Node.js 18 and 20, however, received no fix at all. The first stopped being protected in April 2025 and the second in April 2026; neither one receives any correction anymore, even though they keep running normally.
What this means for you: If a site, application, or tool you use still runs on a software version its maker has abandoned, no one will fix its flaws anymore; ask whoever built it where things stand with its updates.
The Québec government announced on July 14, 2026 more than 10 million dollars in funding for 51 artificial intelligence training projects, aimed at employees of small and medium businesses, under a program called Productivité-Compétences.
Close to 8,000 people and 3,000 businesses stand to benefit, in sectors such as construction, transportation, forestry, manufacturing, and tourism.
The stated goal is to help small businesses use artificial intelligence in some of their tasks to work more efficiently.
What this means for you: The funding targets training, not buying tools; to benefit from it, check with your industry association or Services Québec before paying for equivalent training yourself.
A legal guide published on June 12, 2026 points out that Law 96, which requires businesses to use French (what’s called francization), has applied since June 1, 2025 to businesses with 25 employees or more, instead of 50 before that change.
These businesses must register with the Office québécois de la langue française, the body that checks compliance with the law; 14,366 of them had done so by March 31, 2025.
The Office received 10,371 complaints during the 2024-2025 year, a record high, up 140% over five years.
Fines range from $700 to $30,000 per offence for a first offence, depending on whether it’s an individual or a business; those amounts double, then triple for repeat offences, up to $90,000 for a business, and each day the offence continues counts as a separate offence.
What this means for you: If your business has 25 or more employees in Québec, registering with the OQLF is no longer reserved for large companies; check where you stand before receiving a complaint rather than after.
Canada publishes its artificial intelligence strategy
The federal government published its National Artificial Intelligence Strategy, called “AI for All,” on June 4, 2026.
It aims to strengthen public trust, help the Canadian economy benefit from this technology, and build, in Canada itself, the powerful computers that technology needs, rather than depending on foreign platforms.
Five sectors are given priority: health, energy, transportation, agriculture, and manufacturing.
The strategy also announces a program to help the Canadian public better understand artificial intelligence, but Canada still has no comprehensive law governing this technology, and this strategy doesn’t announce one either.
What this means for you: The government is betting on training and infrastructure before imposing precise rules; until a law exists, it is still up to each business to decide where and how its data feeds an artificial intelligence tool.
A widely used JavaScript tool, booby-trapped on npm
On May 14, 2026, three booby-trapped versions of a tool called node-ipc, used by many programmers who write websites and applications, were published on npm, a large public catalog where programmers go to find free tools.
These booby-trapped versions contained hidden code designed to steal passwords and other credentials, possibly after the account of one of the people responsible for the tool was taken over by someone else; the investigation was still going on at the time of publication.
A little earlier, in March, another very popular tool, axios, had the same problem, affecting millions of downloads.
In both cases, no one needed to break into a server: taking over a single account seems to have been enough to reach a very large number of installs around the world.
What this means for you: The free, shared tools that run a large part of the Internet rely on the good faith and vigilance of a handful of volunteers; a serious provider checks what it installs instead of trusting it by default.
Security researchers publicly announced, on May 11, 2026, that they had found a flaw (a weakness that lets someone do something they shouldn’t) in the remote computers (the cloud) that run surveillance cameras and baby monitors made by Meari, sold under several brand names.
Anyone could create a free account on the service and use it to follow, in real time, the activity of a device belonging to someone else. According to articles published on the matter, more than a million cameras and baby monitors are believed to have been affected.
A second flaw let someone find the Internet address, and so the approximate location, of any device. The manufacturer had been warned before the information was made public, as is good practice in this field.
What this means for you: A connected camera or monitor depends entirely on its manufacturer’s servers; if those servers are poorly protected, the device can show your home to strangers no matter how strong your password is.
On March 24, 2026, the people behind Node.js, a piece of software that runs a large share of websites and applications on the Internet, published their last security update for version 20 of that tool.
Since April 30, 2026, that version has reached what’s called its “end of life”: its official maintainers no longer fix it, even if a serious flaw (an open door that hackers could use) is found in it tomorrow.
A website or application still running on that version keeps working normally, but with no protection against a new attack.
What this means for you: A server or application installed once and left running without follow-up always ends up on an abandoned version; keeping up with updates is part of the job, not a box to check once.
A legal notice published on April 29, 2026 is a reminder of an important rule: Law 25, which protects personal information (your name, address, email, anything that can identify you), applies to every business in Québec, even very small ones.
A business must name a person responsible for that protection and report incidents, such as a data theft. It is also encouraged to list the information it collects, so it knows what it needs to protect.
A business that doesn’t follow the law risks two kinds of penalties: up to 10 million dollars, or 2% of its worldwide revenue, imposed directly by the body that oversees the law, or, in the most serious cases that go before a court, up to 25 million dollars, or 4% of its worldwide revenue.
What this means for you: A small business isn’t safe just because it’s small; the law applies the same way, and a provider that hosts your data should be able to tell you where it is and who can access it.
