Tech news, October 22, 2026
Thursday: 657 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
The morning briefing
As the paper printed it on /brief/ at 08:46 UTC, in the sources' own words.
- LeadLeRobot Trains on Lance, Mining Robot Fleet Data Demo, Vector Search at 10B Scale
LeRobot trains directly from Lance datasets in object storage, a hybrid scan mines robot fleet data for edge cases, and distributed search reaches 1,066 QPS across 10B vectors, pl…
- NewsBank Model Risk Guidance No Longer Covers Generative AI. Who Owns the Testing?
SR 26-2 left generative AI and AI agents out of bank model risk guidance.
- NewsPyPI was subpoenaed
In March and April 2023, the Python Software Foundation (PSF) received three (3) subpoenas for PyPI user data.
- OutageBandwidth Local Market Impairment - 521 - Jefferson City, MO
We are experiencing an impairment on the Bandwidth network which may affect a portion of calls.
- SecurityRe: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
Posted by Christian Fischer on Oct 21 Hello, > On 21.10.2026 16:44 CEST Jakub Zelenka <bukka () php net> wrote: > > Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3…
- Deadlinegemini-omni-flash-preview shuts down today
Replacement: gemini-omni-1.1-flash.
News
202 pieces, the newest 20 here.
- PyTorch Conference North America 2026: Accelerating Open Intelligence Together
PyTorch Conference North America 2026 brought 3,500+ attendees to San Jose on October 20–21 for two days focused on accelerating open intelligence and exploring the impact of PyTo…
- Preliminary Report: Oct 21st Security Incident
Preliminary report detailing Railway's October 21st security incident.
- Eight more TLDs now eligible for a free domain with Pro
Every Pro team can claim a free domain for one year.
- Turning Database Grading into RL Rewards: Post-Training Agents with ThinkingBox
- Custom skills, agents, and MCP servers in usage metrics API
Copilot usage metrics now show the names of the skills, custom agents, Model Context Protocol (MCP) servers, slash commands, and plugins that your organization creates, instead of…
- Single-tenant Titus: VM-level isolation on a multi-tenant container platform
Samartha Chandrashekar & Nick Parker You click play on a Friday night, and in the second that follows, dozens of services answer in milliseconds.
- Google Vault now supports filtered exports for Gemini in Workspace
Google Vault now supports eDiscovery filtered exports for Gemini in Workspace.
- Public Sector Data Modernization for AI Readiness
See how public sector data modernization helps agencies replace legacy systems, unify data and build a secure foundation for AI readiness.
- Release Notes for Safari Technology Preview 255
Safari Technology Preview Release 255 is now available for download for macOS Golden Gate and macOS Tahoe.
- Amazon Connect Customer now supports customizing the Customer Profiles app on the agent workspace
Amazon Connect Customer Profiles now allows administrators to customize which customer data that agents see in the agent workspace, and how it is displayed, using layouts they bui…
- Customer 0 for Sovereign AI: How EDB Runs Mission Control AI on EDB Postgres AI
EDB runs its own revenue reviews, renewals, and executive metrics on the same data and AI platform it sells.
- Expanding Claude availability and deployment choice on Google Cloud
Every organization has unique requirements for building and scaling generative AI.
- AWS Continuum for code vulnerabilities is now generally available
Today, AWS announces the general availability of AWS Continuum for code vulnerabilities.
- Your WarpStream Questions, Answered - WarpStream
WarpStream questions answered — architecture, BYOC vs.
- Cloud Disks are (Really!) Expensive - WarpStream
Cloud block storage costs 24x or more per GiB than S3.
- Amazon OpenSearch Service introduces intelligent ingestion for logs and documents in Amazon S3
Amazon OpenSearch Serverless now offers intelligent ingestion, a fully managed feature that turns logs and documents stored in Amazon S3 into searchable content in Amazon OpenSear…
- Global default for Copilot features generally available
In September, we announced a global default policy for generally available GitHub Copilot features and supported client capabilities on Copilot Business and Copilot Enterprise pla…
- Cohere Model Vault: Verifiable Confidential AI Inference
Explore how Cohere Model Vault secures AI inference with confidential CPU and GPU computing, end-to-end encryption, and remote attestation.
- AWS Continuum for code vulnerabilities is now generally available
AWS Continuum for code vulnerabilities is a new security service that uses AI to automatically find, validate, and prioritize code vulnerabilities in your environment, then delive…
- Replit Monitoring Agent: Your very own software engineering team
Anyone who has published an app knows that dreaded message from a user: “Doesn’t work for me”.
New Models
5 pieces.
- Open model: nvidia/InternVideo2-CLIP-anomaly-detection
New open weights from NVIDIA on the Hugging Face Hub.
- Open model: tencent/WeVisOne-VL-4B
New open weights from Tencent Hunyuan on the Hugging Face Hub.
- Open model: tencent/WeVisOne-VL-2B
New open weights from Tencent Hunyuan on the Hugging Face Hub.
- Open model: tencent/Hy-SimulMT-30B-A3B-Interleave
New open weights from Tencent Hunyuan on the Hugging Face Hub.
- Open model: tencent/Hy-SimulMT-30B-A3B
New open weights from Tencent Hunyuan on the Hugging Face Hub.
Security Desk
81 pieces, the newest 10 here.
- CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion
Posted by Abhinav Agarwal on Oct 22 CISA has published four CVE records and CSAF advisory VA-26-294-01 for vulnerabilities in HAPI FHIR, an open-source Java implementation of HL7…
- ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context
Reduce triage times and focus on the risks that matter most by combining context across code, infrastructure, and runtime
- CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory
Posted by Alan Coopersmith on Oct 22 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outs…
- Plone security fix 20261022: information disclosure
Posted by Maurits van Rees (Plone) on Oct 22 On behalf of the Plone/Zope Security Team I announce an information disclosure vulnerability in `plone.app.content`.
- Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
- Re: Information for Python users regarding eMudhra / emSign CA certificate security incident
Posted by Valtteri Vuorikoski on Oct 22 Having spent the day whacking this particular molehill, my strong opinion is that these packages (minus certifi) should stop vendoring root…
- VU#763488: Memory corruption vulnerabilities in PHP
Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
- Chrome Beta for Desktop Update
The Beta channel has been updated to 157.0.8103.15 for Windows, Mac and Linux.
- CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT Description: aws-c-mqtt is a C99 implementation of the…
- [Security-announce][CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory
There is a MEDIUM severity vulnerability affecting CPython.
Technical Guides
23 pieces, the newest 10 here.
- Microsoft and the Public Library Association expand free AI literacy training
The post Microsoft and the Public Library Association expand free AI literacy training appeared first on Source.
- Controlled self-healing Amazon EKS Clusters with AWS DevOps Agent and A2A remote agents
1.
- Amazon Polly delivers a major upgrade to its Generative engine
The Amazon Polly Generative engine gets a major upgrade: more expressive, more accurate speech with low latency, plus 14 new voices across 9 locales and general availability of Hi…
- How IskayPet unified corporate knowledge with Amazon Bedrock Managed Knowledge Bases
Learn how IskayPet, a leading pet care company in Iberia, built a multilingual corporate knowledge assistant on Amazon Bedrock Managed Knowledge Bases.
- Announcing new ways to customize models with SageMaker AI, without managing GPUs
Amazon SageMaker AI serverless model customization now includes training sessions, generally available today.
- Write your own training loop — without managing GPUs — with Amazon SageMaker training session APIs
Amazon SageMaker AI training session APIs let you write your own LLM training loop (SFT, RL, or custom objectives) in a Python script while the service runs the GPUs.
- Deploy AI in a HIPAA-eligible environment with Amazon Quick
Amazon Quick is a HIPAA-eligible service, but eligibility is not the same as compliance.
- Stream low-latency speech from AI agents using Kokoro TTS on Amazon SageMaker AI
Voice agents often wait for an agent's full response before starting speech synthesis, adding latency users feel directly.
- How to Read Data into GPU Memory in Python with NVIDIA GPUDirect Storage
GPU applications are processing ever-growing datasets with increasingly powerful accelerators.
- Stop guessing auto scaling targets for TTS on Amazon SageMaker AI
Teams deploying custom text-to-speech models on Amazon SageMaker AI often guess at autoscaling thresholds, and a wrong guess either wastes GPU spend or breaches a latency SLO.
AI in the Field
5 pieces.
- This design software reimagines everyday objects as self-aware devices
“X-Hinges” helps design and 3D print items like lamps and gloves with an interactive twist: automatically embedded sensors that perceive and adaptively respond to human contact.
- “Apocalypse Now and Then”: Author Arundhati Roy on Artificial Intelligence, Capitalism & More
Following the People's AI Assembly, acclaimed author Arundhati Roy joins Amy Goodman and Nermeen Shaikh to discuss the rise of artificial intelligence, which she calls "capitalism…
- Your CFO wants SAP AI results next quarter – here’s where to start
The challenge Last month, I sat down with a CIO for a manufacturing company in Johannesburg.
- Agency Information Collection Activities; Proposed Collection; Comment Request; Fraud.gov Tip Intake and Referral Form
The Department of the Treasury, as part of its continuing effort to reduce paperwork and respondent burden, invites the general public and other federal agencies to comment on the…
- Large language models for multimodal clinical predictive modeling: a systematic review
npj Digital Medicine, Published online: 22 October 2026; doi:10.1038/s41746-026-03349-z Large language models for multimodal clinical predictive modeling: a systematic review
Columns
12 pieces, the newest 6 here.
- Why AI Compute Comes in Rectangles — Erik Bernhardsson, Modal CEO
Elastic GPUs, sandbox growth, and the economics of the agent cloud
- AI #191: The Hackening Begins
It was the probably worst day in cybersecurity history.
- What will computer chips look like in 2045?
What I learned from touring Intel’s most advanced fab and talking to its leadership.
- The Pulse: Time to rethink software security because of AI?
A month’s worth of security breaches in a single day – will things get worse before they improve?
- You are the Team — Anekha Sokhal, Moshi
How Moshi turns market data into actionable insights, and why AI tools have to fit the trader’s workflow.
- Why didn’t we use CoRegisterInitializeSpy to clean up the unmarshalable delegate?
Looking more closely at the function's behavior and requirements.
Research
154 pieces, the newest 10 here.
- A Unified Framework for Image-to-3D Part Generation via Variable Granularity
Controllable 3D part generation is pivotal for digital asset creation, yet existing methods lack the flexibility to accommodate diverse user workflows requiring varying levels of…
- Sensorimotor Alignment: A Platonic Proxy for Embodied Policy Success
Robotic foundation models are typically evaluated through costly closed-loop rollouts, which motivates cheap offline proxies for model capability.
- Reading, Writing, Sharing, and Interacting with the World through Video
Video foundation models have advanced rapidly in understanding and generating visual sequences, while video world models seek to capture the underlying dynamics of the world they…
- Direct Pass@$k$ Optimization for Thought Pruning: Balancing Quality and Diversity in Test-Time Reasoning
Test-time scaling has emerged as a key inference strategy for reasoning models, where a model generates a large number of candidate solutions in the hope of finding at least one c…
- Phase Transition from Random Features to Fully Trainable Networks
Constructing accurate and computationally tractable approximation spaces is a fundamental task in scientific computing.
- Reliable AI-Assisted Decisions via Selective Auditing
We consider online monitoring of an AI system that produces a sequence of decisions.
- SpectralCanary: Embarrassingly Simple Low-Frequency Traces for T2I Dataset-Use Auditing
Auditing whether a text-to-image (T2I) model was fine-tuned on a particular image collection is difficult: a model can absorb collection-level visual characteristics without repro…
- Cost-Aware Abstention for LLM-Based IT Ticket Classification
Wrong automatic routing of an IT support ticket can cost more than human triage.
- METTA: Memory-Enhanced Test-Time Adaptation for Meta-Reinforcement Learning
Meta-reinforcement learning aims to train agents that adapt quickly to unseen tasks from limited interaction, but this requires representing task evidence over long interaction hi…
- BrickWright: Agentic Creation of Physically Feasible Brick Builds
Frontier coding agents are becoming increasingly adept at 3D modeling.
Releases
53 pieces, the newest 12 here.
- webpack 5.112.1: Patch Changes
- 1.143.1
- FastAPI 0.161.1: Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @tiangolo
- Claude Code 2.1.309: Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox…
- pnpm 11.28.8
- pkg/v3.272.0: Changelog and go.mod updates for v3.272.0 (#25352)
- openai 7.43.0
- Bun v1.4.4
- Spring Boot 4.1.2: New Features
- OpenAI Node SDK 7.43.0: api, Breaking change in a minor release. A Live response's Decisions question instructions can now be a…
- Pulumi 3.272.0: [cli/display] Collapse policy violations that an exception exempts under Policies: into one line per policy…
- @ai-sdk/zai@3.0.39
New Repos & Packages
26 pieces, the newest 8 here.
Watch
33 pieces, the newest 6 here.
- SIG Autoscaling Bi-Weekly Karpenter Working Group for 2026-10-22T22:00:07Z.mp4
- AI’s Physical Bottlenecks: GPU Markets and the Chip Investment Thesis
- Plan your app’s system spec (No code)
- SIG Scalability Meeting for 2026-10-22
- Meet William Morgan - Speaker at KubeCon + CloudNativeCon North America
- Uber rolls out ChatGPT Work to 30,000+ employees
Package releases
63 from the most used packages' own repositories, the newest 15 here.
- importlib-metadata v9.1.0 · every release →
- claude-agent-sdk v0.2.173 · every release →
- hypothesis v6.170.8 · every release →
- gcp-metadata firestore-v9.4.0 · every release →
- great-expectations 1.24.1 · every release →
- cuda-bindings cuda-pathfinder-v1.8.4 · every release →
- caio 0.12.10 · every release →
- serialize-javascript v7.1.3 · every release →
- @effect/sql-drizzle@0.51.1 · every release →
- @tanstack/history release-2026-10-22-2011 · every release →
- virtualenv 21.14.13 · every release →
- giggsey/locale 2.10.0 · every release →
- strands-agents harness-cli/v0.2.2 · every release →
- @aws-sdk/types v3.1156.0 · every release →
- snowflake-snowpark-python v1.55.3 · every release →