Tech news, October 24, 2026
Saturday: 126 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
The morning briefing
As the paper printed it on /brief/ at 08:46 UTC, in the sources' own words.
- LeadMiniMax M3.1 Flash Now Available on SambaCloud
Frontier Agentic Performance at a Fraction of the Cost.
- NewsContext Engineering with Deep Agents: How To Remember Without Keeping Everything In Context
Long-running agents degrade as context piles up.
- NewsUsage metrics API adds usage from tools like OpenCode
The Copilot usage metrics API now reports model usage from more of the tools your developers use with Copilot, including tools like OpenCode that weren’t previously captured in yo…
- OutageMMS Delivery Delays from Twilio to WOM Colombia
Twilio customers may be experiencing MMS delivery delays from Twilio to WOM network subscribers in Colombia.
- SecurityOVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence.
- Deadlinezai-glm-5-2 shuts down in 7 days
Replacement: Z.ai GLM 5.3.
News
10 pieces.
- PyPI now limits versions to 128 characters
PyPI now rejects new uploads whose version is longer than 128 characters.
- A 30,000-line Rust GPU engine on Expo, and 120,000 installs without ads
Doodraw wraps a 30,000-line Rust engine in one Expo app for iPhone, iPad, Android and Windows, and passed 120,000 installs in 180+ countries with no ads.
- openSUSE Board Election 2026 Begins
The openSUSE Election Committee has announced the start of the 2026 openSUSE Board Election.
- October 24, 2026
App Engine flexible environment.NET Security The following runtime language contains important security updates:.NET 6 and later: 6.0.428, 8.0.415, 10.0.100 The following stacks a…
- MiniMax M3.1 Flash Now Available on SambaCloud
Frontier Agentic Performance at a Fraction of the Cost.
- Speech models in Ollama
Ollama now supports speech models, starting with Phonon from Gradium.
- How Upsy Uses MCP Tasks to Keep Agents in a Meeting
Upsy Meet is a meeting room for AI agents.
- Best Practices for Single Row Lookups (Point Queries)
This blog post covers different techniques to improve the performance of point queries in DataFusion.
- Emergency Legacy Extension now available for NixOS 25.05
Determinate Secure Packages 25.05 (Emergency Legacy Extension) brings critical security support to NixOS 25.05.
- Compromised Certificates and OpenJDK Java Runtimes
As has been widely reported, the private keys of eight eMudhra intermediate CA certificates have been compromised.
Security Desk
10 pieces.
- CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input
Posted by Alexander A.
- PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
Posted by Roman Kuligin on Oct 24 Hello, I have developed a backported.patch for EOL versions of PHP (specifically PHP 5.4, 5.5, and 5.6) to mitigate the critical PHP2Shell Out-of…
- Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)
Posted by Security @ Red Eagle Tech on Oct 24 Hello, CVE-2026-107080 has been assigned to the issue reported here on 5 October 2026.
- CVE-2026-111813 etc: Multiple vulnerabilities in Apache Traffic Server prior to 9.2.16/10.1.5/10.2.1
Posted by Valtteri Vuorikoski on Oct 24 Announcement below was posted to the Apache Traffic Server mailing lists a few days ago.
- Adding Aikido AI pentesting to your existing security stack
Aikido Security's AI pentesting fits into the stack you already run.
- Re: Brotli CVE-2026-111497
Posted by Alan Coopersmith on Oct 24 Yes, https://patchtheplanet.org/brotli reports this as well.
- OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence.
- [Security-announce][CVE-2026-115557] Distrust compromised intermediate certificates in ssl module
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.
- How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943)
Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates.
- DSA-6583-1 libheif - security update
Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images.
Technical Guides
4 pieces.
- An Intro to Threading in Python
Learn how to use Python threading to run tasks concurrently, synchronize threads with locks and queues, and avoid race conditions and deadlocks.
- Three Ways of Storing and Accessing Lots of Images in Python
Compare three ways of storing images in Python, as PNG files on disk, in LMDB, and in HDF5, with timings for reading and writing lots of images.
- Dictionaries in Python
Learn how dictionaries in Python work: create and modify key-value pairs using dict literals, the dict() constructor, built-in methods, and operators.
- Python String Formatting: Available Tools and Their Features
Learn how Python string formatting works with f-strings, the.format() method, and the modulo operator, plus the strengths of each tool.
Columns
6 pieces.
- What Do the Frontier Labs Actually Believe?
I listened to a recent episode of Cal Newport's "Deep Questions" podcast, where he interviews Emile P.
- Seven years from China
I first went to China in 2011, racing for the Lotus/Jetalliance team at Zhuhai in the Intercontinental Le Mans Cup.
- Building Reasoning Models from the Ground Up: A Full Video Course
Over 11 hours of coding videos on evaluation, inference-time scaling, reinforcement learning, and distillation, with Python and PyTorch.
- Be a tech bro
We should all strive to be our brother’s keeper: to look after each other, inspire each other, and simply enjoy each other’s company.
- [AINews] Kimi 3.1 Pro 104BA-2.8T: Fable-5.1-Class Open Weights narrows Closed-AI lead to 1 month... and Pro Highspeed API with 2-3× speed
We have Fable at home...
- “We should be more ambitious with the software we build”
Since early this year, Michael Malis (of pgrust ) has been showing me interesting things he's done and saying [W]e should be more ambitious 1 with the software we build There is,…
Releases
30 pieces, the newest 12 here.
- b11869
- Rust 1.99.0
- Rust 1.95.0
- Rust 1.98.0
- v2026.10.19: Security hardening across trust, installs and provenance; lockfiles now rebuilt completely by default
- providers-keycloak/0.11.2
- providers-smtp/3.2.0
- providers-opensearch/1.15.0
- providers-vespa/0.1.3
- github-v1.2.28: chore(github): pin actions/cache to commit SHA in GitHub Action (#58769)
- @ai-sdk/zai@3.0.40
- @ai-sdk/xai@5.0.30
New Repos & Packages
23 pieces, the newest 8 here.
Watch
8 pieces, the newest 6 here.
- Google’s CEO on His Biggest Bets: Anthropic, SpaceX, Space TPUs, and more
- Inference Will Be $10TRN Market: What No One Sees | Software Investors are F***ed | Naveen Rao
- AI:AM Highlights: Clean Neurons, Black October, the GPU Credit Crunch, and Buying the Supply Chain
- NVIDIA GTC Berlin 2026 | Live Keynote Pregame
- Demo: Build Secure Open Banking Consent Workflows with Agentic AI and MongoDB Atlas
- Open Source Friday: OpenClaw with Hannes Rudolph
Package releases
35 from the most used packages' own repositories, the newest 15 here.
- srsly release-v2.5.5 · every release →
- reactivex v6.1.0 · every release →
- doctrine/doctrine-bundle 3.3.3 · every release →
- react-resizable-panels 4.15.0 · every release →
- jsonpointer v3.5 · every release →
- multidict v7.2.1 · every release →
- http-proxy-middleware v3.0.10 · every release →
- preshed release-v3.0.14 · every release →
- murmurhash release-v1.0.16 · every release →
- apprise v2.1.0 · every release →
- unist-util-visit 5.2.0 · every release →
- unist-util-visit-parents 6.1.0 · every release →
- pyee v16.0.0 · every release →
- rustc-demangle rustfilt-v0.2.2 · every release →
- starlette 1.10.0 · every release →