Tech news, October 19, 2026
Monday: 555 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
The morning briefing
As the paper printed it on /brief/ at 16:23 UTC, in the sources' own words.
- LeadTrace security threats in multi-agent pipelines with Amazon OpenSearch Service
Learn how to trace two invisible threats in a multi-agent AI pipeline, prompt injection propagation and cross-tenant data exfiltration, using Amazon OpenSearch Service and Amazon…
- NewsAutomate Active Directory joins for Elastic Beanstalk Windows applications
AWS Elastic Beanstalk now joins your Windows Server instances to an Active Directory domain automatically at launch, before your application deploys, with no join scripts and no s…
- NewsGet Your .NET MAUI App Ready for Xcode 27
Use an agent skill to prepare your existing.NET MAUI app for Xcode 27, with the scene lifecycle changes and manual migration steps explained.
- OutageDocs.redhat.com - Outage Investigating
We are experiencing intermittent performance issues on docs.redhat.com.
- SecurityNetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance.
- Deadlinegemini-2.5-flash shuts down tomorrow
Replacement: gemini-3.8-flash or gemini-3.5-flash-lite or gemini-3.1-flash-lite.
News
151 pieces, the newest 20 here.
- From personas to archetypes: a living, shared understanding of the people we build for (Part 1 of 2)
Personas are easy to create but often ignored.
- CustomerLake enters Beta: Leading enterprises going live with the Agentic CDP
Today, we’re excited to share a major CustomerLake milestone: Campaign Agents is...
- Building Overexposed: understanding application exposure
Our first scanner read config files and missed what was running.
- Amazon Connect Customer Global Resiliency now provides business users visibility into resiliency readiness across linked Regions
Amazon Connect Customer Global Resiliency now provides a Global Resiliency page in the admin website, giving administrators a single place to review their Region switch readiness.
- Agentic GraphRAG: How does an AI agent use a knowledge graph?
Systems built on basic retrieval-augmented generation (RAG) run into a ceiling: a fixed retrieval path can’t adapt when the question or the underlying data doesn’t match what you…
- The Engineering Manager’s Guide to the Cursor Exodus
Cursor’s changes raise questions about model access and cost.
- Copilot model policy API for enterprise, orgs, and teams
You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, agent apps, and organizations.
- GitHub Copilot models deprecated on October 19, 2026
As of today, October 19, 2026, we have deprecated the following models across most GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code…
- What makes a catalog open? Unity Catalog Advances the Open Lakehouse
While almost every platform now supports open formats, what makes a catalog truly...
- How Amazon CloudFront secures and accelerates the AWS MCP Server
The AWS MCP Server, a managed remote server for the Model Context Protocol (MCP), runs in production behind Amazon CloudFront.
- A Deep Dive on CoreWeave Innovations for NVIDIA Vera Rubin NVL72
CoreWeave was the first cloud provider to bring up and validate NVIDIA Vera Rubin NVL72.
- Teacher-led Gemini Notebook in Google Classroom now offers insight summaries for educators and updated sharing settings for admins, including trusted domains
Following the launch of teacher-led Gemini Notebook in Google Classroom, we are introducing insight summaries for educators.
- [Launched] Generally Available: Metrics usage insights for Azure Monitor workspace
Metrics usage insights is now generally available, giving you greater visibility into what’s driving metrics usage across your Azure Monitor workspace.
- Analyze BigQuery data using natural language with Gemini in Google Sheets
We’re introducing a new way to analyze BigQuery data in Google Sheets.
- How to get the most out of running dbt on Databricks
Tens of thousands of organizations rely on dbt for data transformation.
- Germany Wants to Lead the World in Industrial AI: How NVIDIA Will Help
In the cavernous hall of Kraftwerk, a former power station in Berlin, German Chancellor Friedrich Merz and NVIDIA founder and CEO Jensen Huang sat down to discuss Germany’s AI roa…
- Cutting our inference bill by 68% by being obsessive about optimization
When our AI code reviewer's cost per run doubled, we dug into the token usage to find out why.
- Snowflake Decision Fast: Low-Latency AI Decision Models
Snowflake Decision Fast brings low-latency AI decision models to Cortex AI.
- Amazon CloudWatch Omni is now available in additional AWS Regions
AWS announces that Amazon CloudWatch Omni is now available in eight additional AWS Regions.
- Anaconda Scale 2026: Lessons on Scaling Enterprise AI
Laura Sellers shares lessons from Anaconda Scale 2026, with customer stories from Plug&Pay, Notion, and Tala on scaling AI cost, security, and production.
New Models
3 pieces.
- Open model: inclusionAI/Ling-3.0-flash-Sante
New open weights from inclusionAI (Ant Group) on the Hugging Face Hub.
- Open model: gradium/phonon-31m-en
Trending on the Hugging Face Hub.
- New model: MiniMax: MiniMax M3.1 Flash
MiniMax-M3.1-Flash is a multimodal model from MiniMax.
Security Desk
39 pieces, the newest 10 here.
- CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Posted by Adam Reeve on Oct 19 Severity: moderate Affected versions: - Apache Arrow C++ 4.0.0 before 26.0.0 - Apache Arrow C++ 26.0.0 unaffected - PyArrow 8.0.0 before 26.0.0 - Py…
- Hitachi Energy RTU500 Product
Hitachi Energy RTU500 Product mstradling Oct 19, 2026 Release Date October 20, 2026 Description View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 pro…
- MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
- CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
Posted by Robert Rothenberg on Oct 19 ======================================================================== CVE-2026-111946 CPAN Security Group ================================…
- Eptura security advisory (AV26-1062)
- Red Hat security advisory (AV26-1061)
- PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites
TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026.
- Collaborative Cybersecurity Workshop - Southern California
Collaborative Cybersecurity Workshop - Southern California mnavarro Oct 19, 2026
- Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs)
Posted by Stig Palmquist on Oct 19 CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon…
- CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service
Technical Guides
11 pieces, the newest 10 here.
- Structured outputs for Anthropic Claude models on Amazon Bedrock
Amazon Bedrock now supports structured outputs for all Anthropic Claude models on both the bedrock-runtime and bedrock-mantle endpoints.
- Developers can now access SageMaker Studio through the new AWS experience
New Amazon SageMaker AI customers can now land in a fully configured SageMaker Studio environment in only a few steps.
- Amazon SageMaker JumpStart: 2026 year-to-date in review
Amazon SageMaker JumpStart onboarded over 100 new models from 30 providers in the first three quarters of 2026.
- Accelerating Mamba-2 with High-Performance Forward Pass Kernels in NVIDIA CUDA Tile
NVIDIA CUDA Tile (cuTile) is a Python-based DSL and parallel programming model for NVIDIA GPUs that automatically leverages advanced hardware capabilities to...
- Pegasus 1.5 from TwelveLabs is now available in Amazon Bedrock
TwelveLabs Pegasus 1.5 is now available in Amazon Bedrock.
- How Deepgram optimized voice AI at scale with AWS Trainium
Deepgram worked with the AWS Forward Deployed Engineering team to port its Nova-3 speech-to-text model to AWS Trainium2 for offline batch inference.
- Push-based KV transfer to improve TTFT and TPOT for disaggregated inference in vLLM
vLLM's prefill-decode disaggregation splits LLM inference across engine instances but must transfer the KV cache between them.
- Improve TTFT for multi-turn agentic workloads with bi-directional KV transfer in vLLM
Multi-turn agentic workloads reprocess growing conversation context each turn, driving up latency.
- Developer’s guide to implementing MCP apps in Gemini
Enterprise assistants still respond mostly in text.
- How to Automate Your Workflow With Claude Code Hooks
Learn how to use Claude Code hooks that auto-format your Python code after every edit, enforce your chosen tools, and ping you when a task finishes.
AI in the Field
12 pieces, the newest 6 here.
- Why teaching AI about symmetry could make prenatal diagnosis more reliable
A model developed by researchers at MIT and Boston Children's Hospital adjusts scans on the fly to track fetal movement, potentially sparing families repeat hospital visits.
- UK regulator brings new AI and MedTech agenda to AdvaMed
UK’s Medicines and Healthcare products Regulatory Agency (MHRA) sets out its next phase of MedTech and AI regulation to US industry leaders at AdvaMed 2026.
- Mamdani says feds have abdicated on AI, urges New Yorkers to push back
At The People’s AI Assembly, NYC Mayor Zohran Mamdani argued that the technology’s rapid rollout is not inevitable and that public officials should hold AI companies accountable.
- First harmonised standard supporting the AI Act published in the Official Journal
First harmonised standard supporting the AI Act published in the Official Journal Anonymous (not verified) Mon, 10/19/2026 - 09:37 The European Commission has published the refere…
- Privacy Act of 1974; System of Records
The United States Postal Service (USPS) is proposing to create one Customer Privacy Act Systems of Records, USPS 830.100, Customer Call Center.
- Notice of Revisions to Performance Area One of the LSC Performance Criteria
The Legal Services Corporation (LSC) announces revisions to Performance Area One of its Performance Criteria.
Columns
9 pieces, the newest 6 here.
- AI will not automate radiologists like you think
We have been talking for years now about AI automating jobs.
- Why do we need ud2 when int 6 is right there?
An interrupt is not a fault.
- I Can See Everything
Nick Cammarata of Goodfire makes a bold claim: Neural Networks are Already Clean.
- AI is ushering in an age of personal media
It may be AI slop, but it's my AI slop.
- Import AI 477: In which I tell the IMF the Singularity has begun
Welcome to Import AI, a newsletter about AI research.
- Training AIs to Solve CAPTCHAs
Interesting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from…
Research
154 pieces, the newest 10 here.
- Text-to-Image Generative Modeling Without Language Pretraining
Modern text-to-image (T2I) systems use internet-scale language pretraining for text-conditioned image generation.
- OpenVLHarness: Real World Visual Agentic Tool-Use with Multimodal Memory
Multimodal large language models (MLLMs) have made rapid progress on visual reasoning, yet many tasks require evidence that is difficult to obtain through internal reasoning alone…
- Can It Actually Work? Synthesizing Functional CAD Mechanisms
While LLM agents can generate visually plausible CAD assemblies, these designs often fail to fulfill their intended physical functions.
- Reinforcement Learning with Visually Attributable On-Policy Self-Distillation
Multimodal reinforcement learning with verifiable rewards (RLVR) provides reliable task-level supervision, yet offers limited guidance for localizing errors in visual reasoning.
- VideoMaMa++: Temporally Consistent Video Matting via Preserve-and-Refine Token
Diffusion-based video matting has recently emerged as a leading approach, leveraging video diffusion priors from internet-scale pretraining to achieve strong zero-shot generalizat…
- Ropedia W0: Scaling Loco-Manipulation World Models across Embodiments with Human Experience
World models enable embodied agents to anticipate action consequences, yet jointly modeling locomotion and manipulation across diverse embodiments remains challenging due to heter…
- InfiniDream: Open-Ended Photorealistic 3D Worlds Through Procedural Generation
Procedural generation plays a key role in synthetic data creation and game development, offering greater controllability, editability, and diversity than static mesh representatio…
- CoopUQ: Robust Multi-Robot Social Navigation via Uncertainty-Aware Cooperative Forecasting
Reinforcement learning enables mobile robots to make fast and scalable navigation decisions in constrained human-shared environments.
- Manga2Animate: An Agentic Framework for Faithful Manga Animation with Script and Storyboard Planning
Adapting existing manga into coherent animation that stays faithful to the source is a valuable yet challenging task.
- GenOlympiad: Benchmarking Frontier Image Models at Their Capability Boundaries
Text-to-image models have made tremendous progress and can produce high-quality images.
Releases
44 pieces, the newest 12 here.
- FastAPI 0.150.0: When no file is selected, browsers submit a file part with an empty filename and empty content. FastAPI now…
- Claude Code 2.1.304: Added a transcript line when a plugin that runs first skips one of your mod's hooks, naming the event and…
- uv 0.13.2: Released on 2026-10-19
- archive/pr15095
- Patch release v5.20.2
- oxlint v1.89.0
- oxfmt v0.74.0
- Xcode 27.2 RC (27B48)
- iOS 27.2 RC (24B115)
- iPadOS 27.2 RC (24B115)
- DeepSeek-V4.1 & FLUX-3
- Release v26.9.22.3-stable
New Repos & Packages
32 pieces, the newest 8 here.
Watch
32 pieces, the newest 6 here.
- Building agents that can pay with AWS and Stripe
- Cooking with Codex: Ep. 1
- How to Build Customer 360 Profiles with AI | CustomerLake Profile Agents Demo
- Introducing Agent Memory on Databricks
- Someone Used ChatGPT to Spy on OpenAI (And Got Caught)
- The AI Reality. The Human Response. | Black Hat Europe 2026, London
Package releases
68 from the most used packages' own repositories, the newest 15 here.
- holidays v0.107 · every release →
- @formatjs/ecma402-abstract @formatjs/intl-datetimeformat-calendar-dangi@1.1.2 · every release →
- fast-uri v2.4.8 · every release →
- gcp-metadata cloudbuild-v6.3.0 · every release →
- chokidar 6.0.0 · every release →
- zircote/swagger-php 6.17.1 · every release →
- setuptools v84.2.0 · every release →
- httpx2 v2.15.1 · every release →
- webpki-roots v/1.0.10 · every release →
- inquirer@14.2.4 · every release →
- markdown 3.11.2 · every release →
- @aws-sdk/types v3.1153.0 · every release →
- aws/aws-sdk-php 3.401.3 · every release →
- dragonmantank/cron-expression v3.6.1 · every release →
- robrichards/xmlseclibs 4.0.1 · every release →