Keyboard shortcuts
New here? A new edition every day at 10:00 UTC, from primary sources only — no feed, no ranking by clicks, no account. What it is · How it works →
Get the paper when it's out — each morning, and when something breaks.
Put the paper on your home screen
Like the pieces you said were worth your time. Worked out in this browser only.
Announcements from the labs, companies and platforms themselves.
The few things to know today, in two minutes →

AI coding agents changed how fast teams ship. They didn’t change who has to verify the output. Last week, Qodo field CTO Shlomo Dalezman and solutions engineer Jonathan Klick ran a live session on what happens when code review stops waiting for the pull request. They walked…

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Oct. 9 - 15. This week highlights KDE’s 30th anniversary and the premiere of the KDE documentary, the launch of Pl…

This update includes a minor upgrade to Chromium 152 (Extended Stable Release) from upstream, which in turn includes security fixes from Chromium 155.
More on Desktop 8.2 · Desktop

DeepSeek V4.1 Flash 1017 is now available on AI Gateway. DeepSeek V4.1 Flash 1017 is a minor update to DeepSeek V4.1 Flash that improves reasoning, coding, agentic tasks, and image understanding. The coding gains show up in terminal work and in building and editing whole reposito…
More on Flash 1017 · Flash

Reflection’s open-weight Beam model on CoreWeave spans training with Weights & Biases Models, SFT in partnership with Axolotl, and Day 0 API access on Serverless Inference in CoreWeave Forge.

Multi-Statement Transactions are Generally Available, enabling organizations to run...

A new Linux kernel vulnerability, nicknamed PwnEscape ( CVE-2026-99999 ), has been disclosed. It is a guest-to-host virtual machine (VM) escape: anyone who controls a guest VM can send specially crafted network packets that leak the host’s kernel memory, crash the host, or,…

The App Review Guidelines have been revised to support new features, updated policies, and to provide clarification. App Review Guidelines Before You Submit: Added links to additional documentation. 1.2: Clarified app content and app types that are subject to this guideline, and…
Amazon CloudWatch log centralization is now available in AWS GovCloud (US) and 13 additional commercial Regions. CloudWatch log centralization copies log data from multiple AWS accounts and Regions into a single destination account, integrating with AWS Organizations for efficien…

Teams running distributed SQL in production face a trade-off. A managed service removes the work of upgrades, scaling, and backups, and it moves the database into the vendor’s cloud account. Self-managing TiDB keeps the database in your account and leaves every upgrade, backup, a…

The App Review Guidelines are a core part of the safe and trusted experience that the App Store strives to offer users around the world — and the foundation of that trust is clear standards that are consistently enforced. As outlined in our App Review Guidelines, pornographic mat…

The OSI has teamed up again with Perforce Zend and OpenLogic, as well as the Eclipse Foundation, for the 2027 State of Open Source Survey.

TidesDB now exists inside MariaDB as a pluggable storage engine. With the TideSQL plugin available, anyone can load TidesDB into a MariaDB server and begin experimenting with it. But having a plugin is only the first step — you still need a practical, reproducible way to run real…
With ia.i, a conversational interface, and the IARA governance platform, Itaú is applying its AI First strategy to customers and employees — in one of Brazil’s most regulated sectors.
Google Meet now uses post-quantum cryptography Calls in Google Meet will use post-quantum cryptography (PQC) for extra protection, starting now with laptop web clients and meeting room hardware, with mobile support coming soon. There are no visible changes, and you can continue u…
The people building AI, writing on their own blogs. Last 30 days.

a quiet day lets us pilot a new show
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

The Firefox team are asking us to weigh in on proposals for Interop 2027—what features should browsers be concentrating on implementing or improving. Here are my top five: Web app installation via <install> and navigator.install(). Prompts the user to install a progressive…

The best Stratechery content from the week of October 12, 2026, including what Apple is doing, SpaceX's appetite, and the title, takes, and the Washington Wizards.

Hot on the heels of reading and enjoying The Mountain In The Sea, I picked up Ray Nayler’s next work, this tightly constructed novella. Once again it deals with inter-species communication. This time it’s de-extincted mammoths. Once again, it’s set in the relatively near future.…

Getting the results back out. The post C++ futures part 5: <CODE>std::<WBR>future</CODE> and <CODE>std::<WBR>shared_future</CODE> appeared first on The Old New Thing.

AI might not yet be eating the physical world. AI is still eating the world of news, and I am finding less and less opportunity to post about other things. My backlog of items grows across most of my secondary … Continue reading →
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modifi…
Tutorials, case studies and technical deep dives.






New models, as they become available.








Vulnerabilities exploited in the wild (CISA), critical advisories in the ecosystems devs build on (GitHub), and the security teams' own reports.
Remote DoS through unchecked `IdList` allocation in negentropy
Stack overflow when parsing deeply nested input in pest_grammars
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. If an affected copy…
Posted by eddyflores100 on Oct 16 Alexander, Fair on both counts, and thank you for verifying the domain state yourself before responding - that is more diligence than the posting deserved in the shape it was sent. Two process corrections, both accepted: 1. Disclosure: the follow…
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
Artificial Intelligence technologies have made a huge impact on the security industry. But as with any public technology, adversaries have access to AI as well. They’re wasting no time incorporating AI into their malicious workflows and ransomware operators have been able to leve…
Incidents from the status pages of the services developers build on, as each provider reports them.
| Service | Incident | Status | Reported |
|---|---|---|---|
| Snyk | Snyk Code Performance Degraded in SNYK-US-02 | Ongoing · Minor | Oct 16, 1:43 AM UTC |
| 1Password | High error rate on 1Password.com | Ongoing · Major | Oct 16, 11:45 PM UTC |
| Twilio | SMS Delivery Delays and Failures from a Subset of Twilio Alphanumeric Sender IDs and Long Codes to Multiple Networks in Czech Republic | Ongoing · Minor | Oct 16, 5:16 PM UTC |
| SendGrid | SMS Delivery Delays and Failures from a Subset of Twilio Alphanumeric Sender IDs and Long Codes to Multiple Networks in Czech Republic | Ongoing · Minor | Oct 16, 5:16 PM UTC |
| Temporal Cloud | New namespace creation restricted across all GCP regions | Ongoing · Minor | Oct 15, 5:12 PM UTC |
| Scaleway | [DC3] - Public Switch Unreachable at DC3, Rack S46-E16 | Ongoing · Minor | Oct 15, 8:17 AM UTC |
| Fireworks AI | Service Degradation for Qwen 3.8 Max | Resolved | Oct 17, 8:22 AM UTC |
| Fireworks AI | Service Degradation for Qwen 3.8 Max | Resolved | Oct 17, 7:22 AM UTC |
New arXiv papers in AI, language, machine learning and software engineering.
Context caching is widely adopted to reduce the dominant prefill cost for long prompts across various large language model (LLM) applications. Recently, position-independent caching (PIC) has emerged to improve KV cache reuse beyond strict prefix matching. However, the required K…
For widespread deployment of autonomous driving systems (ADS), perception robustness plays a fundamental role. However, maintaining robust perception performance remains a significant challenge, especially under occlusion-rich conditions, known as blind-spot driving scenarios. In…
Fully Homomorphic Encryption (FHE) has the potential to substantially improve privacy and security by enabling computation directly on encrypted data. This is especially true in deep learning, as many popular user services today are powered by neural networks in the cloud. Beyond…
Session-based recommendation (SBR) predicts the next item based on anonymous sessions. Traditional SBR explores user intents based on ID collaborations or auxiliary content. To further alleviate data sparsity and cold-start issues, recent Multimodal SBR (MSBR) methods utilize sim…
Sequential recommendation generates personalized item rankings by estimating latent user-preference distributions from historical interactions. Although Diffusion Models (DMs) have gained prominence due to their exceptional capacity to capture complex distributions, current DM-ba…
Agentic and multi-agent AI systems are increasingly deployed as part of operational systems, introducing autonomous planning, delegation, persistent memory, tool use, and inter-agent coordination into data-driven decision making. These architectural properties challenge prevailin…
The ancient art of Traditional Chinese Medicine (TCM) is distinguished by its extensive annals of utilizing nature's botanical emissaries to ameliorate various pathological conditions. TCM diagnosis and treatment exhibit a pronounced degree of personalization and an organically h…
Recommender systems (RS) increasingly mediate what users see, buy, and believe, making them attractive targets for malicious manipulation. As RS have progressed from traditional collaborative filtering to deep learning and, most recently, LLM-driven designs, the landscape has co-…
Stable versions of the tools and libraries we track. Prereleases are left out.
| Project | Version | Date |
|---|---|---|
| ClickHouse | Release v26.3.54.6-lts | Oct 17 |
| llama.cpp | b11710 | Oct 17 |
| llama.cpp | b11711: cuda : fix -Wtautological-compare in fattn vec dispatch (#30519) | Oct 17 |
| llama.cpp | b11709 | Oct 17 |
| Rollup | v4.64.8 | Oct 17 |
| Unsloth | Meta Muse Spark Open + NVIDIA Nemotron 3.5 | Oct 17 |
| Neovim | Nvim development (prerelease) build | Oct 17 |
| Electron | electron v44.9.0 | Oct 17 |
| Cline | Desktop v0.0.48 | Oct 17 |
| ComfyUI | v0.41.3 | Oct 17 |
New repositories under the GitHub topics we track, and packages published to npm.
Rising on GitHub this weekMCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server
Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.
Create a tested Tangle agent application with either a tool loop or a complete chat interface.
Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.
MCP (Model Context Protocol) adapter extension for Pi coding agent
Plannotator Pi extension - interactive plan review with annotations, annotate agent messages, and review code/PRs
I gave Claude Code 120 pages of my handwritten college notes. It gave me back my handwriting as a real font, in 66 minutes for $13.68.
Run AI models locally on your machine with node.js bindings for llama.cpp. Enforce a JSON schema on the model output on the generation level
AI at work outside tech — in health, science, finance, government and more — from the users, regulators and journals themselves. Only real use: deployments, approvals, trials, results.

Online sports betting company DraftKings is using AI to target customers who are most likely to place losing bets and respond to gambling promotions. This kind of targeting is a form of online behavioral advertising, which is when companies personalize the ads they show you based…

Healthcare organizations are being asked to widen access, protect increasingly thin margins, and keep clinicians from burning out. Telehealth is one of the most effective levers on all three, and it’s no longer a pandemic stopgap: 71.4 percent of physicians now use it weekly, nea…

A peer-reviewed study in The Lancet evaluates Google's AMIE medical AI in a real-world primary care clinic.
F1 worked with AWS to migrate petabytes of footage from ageing tape robots, in multiple formats and proxy files, into Amazon Simple Storage Service (Amazon S3) alongside the live footage from every new race. That gave the sport one durable home for its heritage: the F1 Video Arch…
Agency charged that the company deceptively marketed cash advance services and obstructed cancellations The Federal Trade Commission is sending more than $15.8 million to consumers impacted by cash advance app company Cleo AI’s deceptive claims about the amounts and timing of ava…

Google is helping health leaders overcome reporting lags, forecast disease outbreaks, and deliver care to vulnerable communities.
Launches, keynotes, demos and talks from the makers' own channels, and interviews with the people who build it. A video loads from YouTube only when you press play.
That's the paper. The next one closes tomorrow morning.