Tech news, September 18, 2026
Friday: 140 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
News
46 pieces, the newest 20 here.
- Cypress Cloud: Test Replay now masks sensitive form inputs by default
Starting today, Test Replay replaces the values of sensitive form fields (passwords and payment details) with asterisks before it captures the DOM before any Test Replay data is u…
- Spend Management expands to Enterprise Flexible Commitment plans
Enterprise teams on Flexible Commitment plans can now use Spend Management, already available on Pro, at no additional cost.
- AWS Continuum now supports credential testing and accessible domain suggestions
AWS Continuum for penetration testing is a frontier agent that proactively secures applications throughout the development lifecycle by offering on-demand, customized penetration…
- WebMCP support now available in mcp-handler
mcp-handler now has experimental support for WebMCP, the proposed web standard for exposing tools to in-browser agents.
- MilleMiglia: A realistic instance generator for middle-mile logistics
Algorithms & Theory
- Amazon ECS Express Mode now supports AWS Graviton (ARM64) workloads
Amazon Elastic Container Service Express Mode now supports specifying ARM64 as the CPU architecture for your service, making it easy to deploy ARM-based container images on AWS Gr…
- v0 now reads npm credentials from shared environment variables
v0 now installs private packages from npm and custom registries using credentials stored as shared environment variables on Vercel.
- Build for iPhone Duo with new resources
Get Xcode 27.1 beta.
- Proposed change to DSF voting membership
We're proposing a new voting membership status to help us track active members.
- Introducing Kimi K3 on Amazon Bedrock
Kimi K3 from Moonshot AI is now available on Amazon Bedrock, giving you a powerful new open-weight option for coding and knowledge work.
- Announcing Native BM25 Ranking in AlloyDB and Cloud SQL
Vector search is a critical component of generative AI, retrieval-augmented generation (RAG), and data agent architectures, but sometimes vector search alone isn't enough.
- Leave the Class Path in the Rearview Mirror
Introducing composable, module system native and agent friendly command line tools for modern Java development By Danny Thomas, JVM Ecosystem Team Recent work on the Java language…
- Accelerating the borderless Lakehouse: Announcing preview of cross-cloud caching
Today, we are excited to announce enhancements to the borderless Lakehouse, our answer to how data engineers, data scientists, and increasingly, AI agents, can query governed data…
- Changing the game: Using agentic AI to secure infrastructure code
AI is accelerating software development at an unprecedented pace.
- The new AgentCore runtime: Elastic, optimized, and consistently fast starts
Today we are announcing the new AgentCore runtime, a capability of Amazon Bedrock AgentCore built for the speed, flexibility, and cost efficiency that production agents demand.
- Kimi K3 by Moonshot AI is now generally available on Amazon Bedrock
Amazon Bedrock continues to expand its open weight model portfolio with the same security and governance that customers rely on. Today, Kimi K3 from Moonshot AI is generally…
- Should you read the code, is RAG dead, and did Skills kill MCP?
We dive into these questions and other AI hot takes on the latest episode of the GitHub Podcast.
- New experts join Google’s AI & Economy team
We are expanding our AI & Economy team with world-class academic advisors, fellows, and core internal researchers.
- The AIDEs Framework: How We Built a “Theory of Everything” for AI Development Tools
We are living in genuinely interesting times.
- Making Local AI Smarter and Faster
We want local coding agents to be smart and fast, with the ability to understand a codebase, do useful work, and finish tasks without long waits.
New Models
6 pieces.
- New model: PrismML: Ternary Bonsai 2 27B
Bonsai 2 27B is a 27B-parameter reasoning model from PrismML derived from Qwen3.8-27B.
- New model: Z.ai: GLM 5.3 FlashX
GLM-5.3-FlashX is the high-speed variant of Z.ai's GLM-5.3-Flash, a native multimodal model delivering inference speeds of up to 200 tokens/s.
- Open model: moondream/parakeet-redux
Trending on the Hugging Face Hub.
- Open model: convaiinnovations/laya
Trending on the Hugging Face Hub.
- New model: TypeSafe: Jev Latest
This model always redirects to the latest model in the Jev family.
- New model: TypeSafe: Jev 1.13
Jev is a structured decision model from TypeSafe, and the first of its System One models.
Security Desk
19 pieces, the newest 10 here.
- Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
- Critical: Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
Affects mnemosyne-memory.
- Critical: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Affects github.com/kcp-dev/kcp.
- Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
- Chrome Dev for Android Update
Hi everyone!
- Chrome Dev for Desktop Update
The Dev channel has been updated to 156.0.8063.3 for Windows, Mac and Linux.
- How Kyocera AVX Built a Global Security Validation Program from Zero
See how Kyocera AVX used NodeZero to build a global security validation program, scale autonomous pentesting across manufacturing sites, and remediate more than 30,000 vulnerabili…
- Critical: org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
Affects org.xwiki.rendering:xwiki-rendering-xml.
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsisten…
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socke…
Technical Guides
18 pieces, the newest 10 here.
- ReadyOn’s Four Walls of tenant isolation on Amazon EKS
ReadyOn runs a multi-tenant platform on Amazon EKS that handles highly sensitive enterprise data.
- Amazon SageMaker Inference: 2026 year-to-date launches in review
Amazon SageMaker AI shipped 13 inference launches in year-to-date across two deployment paths: fully managed endpoints and Amazon SageMaker HyperPod Inference.
- Benchmarking LLM Inference at Scale with AIPerf
You’re deploying a model on a system.
- Saving another 100TB of RAM with math (and Rust)
Cloudflare's global network is immense but not limitless.
- Migrating multi-model AI agents to Amazon Bedrock AgentCore runtime
Migrate a multi-model healthcare AI agent from self-managed Amazon ECS with AWS Fargate to Amazon Bedrock AgentCore runtime, preserving triple-model orchestration and vector-enhan…
- Running self-hosted AI agent sandboxes with AWS Lambda MicroVMs
Learn how to run AI agent tool calls in secure, isolated sandboxes using AWS Lambda MicroVMs.
- How CSIRO built scalable, cost-optimized genomic variant querying on AWS
Learn how researchers at CSIRO, Australia's national science agency, built Serverless Beacon (sBeacon), a scalable serverless solution for securely querying genomic variant data o…
- Dual-exporting .NET metrics with OTLP and Prometheus
Many applications export their metrics directly to Prometheus.
- How a global fintech scaled coding agent traffic with Dedicated Model Inference
Inside a global bank's shift to self-serve dedicated inference: how Together's DMI gave engineering teams direct control over scaling, models, and testing.
- Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
In August 2026, Hacktron reported what looked like a remote code execution (RCE) vulnerability in Next.js image optimization.
AI in the Field
3 pieces.
- EFF Statement on California Governor's Executive Order on AI
California Gov.
- AWS and SAP Expand Collaboration for SAP Business AI Platform
At SAP Sapphire 2026, AWS announced a Strategic Collaboration Agreement (SCA) with SAP to expand the availability of SAP Business AI Platform on AWS worldwide.
- Cybernetics, interoception, and the art of embodiment
Nature Machine Intelligence, Published online: 18 September 2026; doi:10.1038/s42256-026-01312-x Living organisms continuously monitor their internal physiological states while in…
Columns
4 pieces.
- The Overhang
Using your deep knowledge, wide knowledge, taste, and agency
- AI Evals: Everything You Need to Know
This document curates the most common questions Shreya and I received while teaching 5,000+ engineers and PMs AI Evals.
- How I Vibed a Proof of Conway’s Conjecture
You can just prove things, apparently.
- There's no point at which turning your brain off will work
In early 2025, I started seeing people turn off their brain as they use LLMs 1.
Research
3 pieces.
- GNN-LS: An Information-Enhanced Method for Label Scarcity on Graphs
Label scarcity severely hinders the performance of the node classification task on graphs.
- Enabling Retriever-LLM Connection Across the Semantic Gap in Retrieval-Augmented Generation
Retrieval-augmented generation (RAG) has attracted significant attention for enhancing large language models (LLMs) in domain-specific and knowledge-intensive tasks by utilizing e…
- Efficient Discovery of Motif Transition Process for Large-Scale Temporal Graphs
Understanding the dynamic transition of motifs in temporal graphs is essential for revealing how graph structures evolve over time, identifying critical patterns, and predicting f…
Releases
21 pieces, the newest 12 here.
New Repos & Packages
8 pieces.
Watch
12 pieces, the newest 6 here.
- Text2SQL From Academic Benchmarks to Self Service Analytics (Sponsor: JetBrains)
- Pydantic Monty: Wild LLMs, from tool calling to computer use (Sponsor: Pydantic)
- Vibe Cloud to production with Gemini (Sponsor : Google)
- Custom Connectors & Expanded Audit Logs | This Week in Replit (Sep 18, 2026)
- Dream it, Build it, Ship it! | GitHub Copilot Day
- Why Would AI Companies Want to Slow Down?