Tech news, October 28, 2026
Wednesday: 545 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
The morning briefing
As the paper printed it on /brief/ at 08:46 UTC, in the sources' own words.
- LeadMalware Package Analysis: aiocpa
On 2024-11-21, PyPI was notified about a malware attack with few details.
- NewsBuild an “ask the docs” app with Laravel 13 and MariaDB Vector
Earlier this month we wrote that Laravel 13 now supports MariaDB Vector natively.
- NewsUI improvements – Vivaldi iOS Browser snapshot 4190.71
In today's snapshot, we've made several UI improvements and fixed a handful of bugs.
- OutageRoute delays in EU Region
We are currently investigating this issue.
- SecurityCVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
- Deadlinezai-glm-5-2 shuts down in 3 days
Replacement: Z.ai GLM 5.3.
News
182 pieces, the newest 20 here.
- [Podcast] Quad9 — Measurement in the privacy-preserving public DNS service
Darren Kara discusses how the Quad9 Public DNS server balances privacy, measurement, and global threat intelligence to help protect users from malicious destinations.
- Preparing for your next certification could start with your Visual Studio Subscription
Are you thinking about earning a Microsoft certification to help advance your career, build on your existing skills, or meet new requirements at work?
- Why you should stop using ARBITERS in MongoDB
This blog post was born of a discussion with a colleague in Percona Support, who also co-authored it with me here on the use of the ARBITER feature in MongoDB installations nowada…
- Amazon RDS for Oracle now supports September 2026 Monthly Recommended Patch
Amazon Relational Database Service (Amazon RDS) for Oracle now supports the September 2026 Monthly Recommended Patch (MRP) for Oracle Database version 19c and 26ai.
- Volcano v1.16 Released: NamespaceQueue, fairshare, and a broader HyperNode ecosystem
Volcano v1.16.0 is available.
- Join us for OpenTelemetry Talks and Activities at KubeCon NA 2026
The OpenTelemetry project maintainers, members of the governance committee, and technical committee are thrilled to be at KubeCon NA in Salt Lake City from November 9 - 12, 2026.
- Changing course: How Drive the Future helped students find their own path to success
Drive the Future 2026 — an event program organized by Arm, Aston Martin Aramco Formula One® Team, and Texas State Technical College — showed students that success isn't always str…
- CoreWeave Builds the First Global Backbone Network Purpose-Built for AI
One global AI network, four continents.
- The Capacitor 9 Beta is here
Capacitor 9 Beta was published today, and headline items from The Road to Capacitor 9 are now available for testing.
- Amazon Bedrock AgentCore CLI version 1.0 is now available
AWS announces the general availability of Amazon Bedrock AgentCore CLI version 1.0 (@aws/agentcore 1.0.0), rebuilt with faster startup, a consistent command structure, and support…
- Ship less JavaScript in Next.js with your AI agent
Optimize your Next.js app's bundles with the next-bundle-optimizer agent skill, or explore them yourself with new Bundle Analyzer tools.
- Evernote turns AI-driven discovery into paid subscriptions
Evernote used ChatGPT Ads to introduce its note-taking app to people working with AI.
- Observing AWS Lambda durable functions with the Durable Execution Telemetry Exporter
Durable functions span many Lambda invocations, so per-invocation logs answer the wrong question.
- A JSON schema Is not an AI governance layer
The AI governance argument is happening one layer above the code that actually stops your agent.
- Vercel CI is now in beta
You can now run CI for your Turborepo with one line of configuration.
- ViBench 2.0: A Benchmark for Long-Horizon Software Building
Today we’re releasing ViBench 2.0, a benchmark for long-horizon software development.
- PostgreSQL to SQL Field Notes: Operational Statistics
Welcome to SQL First, welcome to SQL!
- AWS Lambda supports Seekable OCI (SOCI) lazy loading for Lambda Managed Instances
AWS Lambda now supports Seekable OCI (SOCI) for lazy loading Event Functions packaged as Open Container Initiative (OCI) images running on Lambda Managed Instances.
- Node.js 24.22.2 (LTS)
- Introducing time series collections for the next generation of Amazon OpenSearch Serverless
Today, we're announcing support for time series collections on the next generation of Amazon OpenSearch Serverless.
New Models
6 pieces.
- New model: AssemblyAI: TTS 1
AssemblyAI TTS 1 is a text-to-speech model from AssemblyAI.
- New model: Particle AI: Particle-1
Particle-1 is a token-efficient agentic coding model from Particle AI, post-trained on DeepSeek V4.1 Flash.
- Open model: speridlabs/idol
Trending on the Hugging Face Hub.
- Open model: sensenova/SenseNova-Loop-9B-Preview
Trending on the Hugging Face Hub.
- Open model: Lightricks/LTX-2-Marking
New open weights from Lightricks on the Hugging Face Hub.
- Open model: ibm-granite/LLMON-Benchmarks
New open weights from IBM Granite on the Hugging Face Hub.
Security Desk
69 pieces, the newest 10 here.
- CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could al…
- Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Cataly…
- Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to b…
- Critical: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
Affects electrum.
- Critical: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Affects wasmtime.
- Critical: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Affects zip.
- CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
Posted by Andrew Stitcher on Oct 28 Severity: low Affected versions: - Apache Qpid Proton C through 0.40.0 Description: A misconfigured wildcard TLS certificate causes a stack rea…
- CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0.40.0 Description: When dispatching SASL frames to authenticate the peer…
- CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0.40.0 Description: A message body that is deeply nested and decoded by p…
- CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0.40.0 Description: When using the OpenSSL TLS implementation, both the p…
Technical Guides
10 pieces.
- High-throughput enterprise-scale document migration on AWS
Migrating hundreds of millions of documents to the cloud is a defining enterprise challenge – data loss, downtime, or compliance gaps break traditional approaches.
- Building an Agentic AI Platform on Amazon Bedrock AgentCore
Stand up a governed, multi-account Agentic AI Platform on Amazon Bedrock AgentCore.
- Distributed training with Ray Train DLCs and EFA on EKS
The Ray Train Deep Learning Container ships the full CUDA-through-EFA stack, so you build no image.
- Accelerating software delivery with agentic QA automation using Amazon Nova Act – Part 3
As QA test automation spreads across an organization, organizing tests and controlling who owns them becomes the real work.
- How resource tagging scopes the AWS Transform connector role
AccessDenied during an AWS Transform migration is often a missing or incorrect tag.
- Behind the scenes, two months later: How we ship Google Agent Skills like products
In my previous post, I took you behind the scenes of Google Agent Skills, covering how the project started, how we maintain quality at scale, and how we handle governance.
- How Nubank automated disaster recovery with the AWS DevOps Agent
Nubank serves more than 140 million customers across Brazil, Mexico, and Colombia and announced in 2026 its operation in the USA, over 60% of Brazil’s adult population.
- DigitalOcean Managed Agents latency: cold start and resume
We timed 2,280 agent sandboxes on DigitalOcean Managed Agents and found our first resume measurement was wrong: polling reported 540 ms, but the session was ready the moment the r…
- Build a Python MCP Client to Test Servers From Your Terminal
Follow this Python project to build an MCP client that discovers MCP server capabilities and feeds an AI-powered chat with tool calls.
- Quiz: Creating a Scalable Flask Web Application From Scratch
Test your understanding of Flask project structure, from the application factory and blueprints to Jinja templates and static files.
AI in the Field
7 pieces, the newest 6 here.
- Victory! You Can Now Exclude Apps from Siri AI
In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Alr…
- How Toyota Built BasisPilot – an AI Assisted SAP Operations Platform on AWS
This blog was co-authored in close partnership with Toyota Motors North America SAP team: Manish Kumar, Anshuman Kowtha, and Ashish Patel.
- 3 Questions: Why infrastructure is entering a defining era
Professor Ali Jadbabaie describes how AI, digital transformation, climate change, and complex geopolitics are forcing engineers and policymakers to rethink how infrastructure is d…
- Making machines that can listen
Professor Paris Smaragdis develops computers with superhuman hearing for applications like speech recognition, music understanding, and environmental monitoring.
- ETC Tiger Pipeline, LLC; Notice of Schedule for the Preparation of an Environmental Assessment for the Franklin Farms Project
- Internal Revenue Service Advisory Council; Public Meeting
The Internal Revenue Service Advisory Council will hold a public meeting.
Columns
10 pieces, the newest 6 here.
- Why Agents Love Supabase
Paul Copplestone and Ant Wilson on building the backend for AI agents
- C++/WinRT overcorrection: Using make_self and immediately converting it to the projected interface
You are taking the scenic route.
- The October inflection point for vibe game development
I've written before about how November 2025 was an inflection point for coding agents - the point where Opus 4.5 and GPT-5.1 crossed a tipping point that meant their respective co…
- Artificial Analysis v5 and the benchmarker's dilemma
A sort of review of the benchmarking industry and what's missing.
- Fragments: October 28
Andrej Karpathy sees a widening gap in how people see LLM capabilities.
- Anthropic Files Its S-1
The full text is finally here, so we are giving it the full RTFB of model card treatment.
Research
10 pieces.
- Kanopia: Monitoring Forests with Drones and AI
Kanopia: Monitoring Forests with Drones and AI emilie.germain… Wed, 10/28/2026 - 11:18
- Replacing Output Parameters with Algebraic Data Types in C-to-Rust Translation
Translating legacy systems from C to Rust promises to enhance their reliability.
- A Systematic Review of the Use of Motion Capture in the Digital Humanities
In this article, we present a Meta-Analysis of 103 papers that report on the use of motion capture technologies (mocap) in qualitative research and the digital humanities.
- A Survey on the Evolution and Future Trajectory of Flow Cytometry Analysis
Flow cytometry is a powerful analytical technique that generates high-dimensional single-cell data widely used in biological research and clinical diagnostics.
- A Survey of What to Share in Federated Learning: Perspectives on Model Utility, Privacy Leakage, and Communication Efficiency
Federated learning (FL) has emerged as a secure paradigm for collaborative training among clients.
- A State-Of-The-Art Review of Industrial Time Series Data Analysis: Methods and Applications
The Industrial Internet of Things (IIoT) is characterized by the generation of vast amounts of time-series data.
- Scaling Laws of Data-Driven Machine Learning Models: A Survey and Taxonomy
In recent years, there has been a notable surge in research dedicated to data-driven paradigms, which use existing data to train models capable of applying learned principles to r…
- A Fairness-Aware Management for Multi-Tier Storage Systems
Modern cloud storage systems serve multiple tenants with diverse I/O behaviors and make fairness under shared resource contention a critical requirement.
- Optimizing Deep Neural Network Sparse Kernels on Multi-core CPUs
Vector-wise pruning is widely used to reduce the inference cost of deep neural networks (DNNs), but it turns key operators into sparse convolution (SpConv) and sparse matrix-matri…
- Supervising the search process produces reliable and generalizable information-seeking agents
Releases
47 pieces, the newest 12 here.
- Biome CLI v2.6.4
- LiteLLM 1.106.6: Verify Docker Image Signature
- LiteLLM 1.105.7: Verify Docker Image Signature
- Temporal 1.33.0-165.1: patched temporal version
- OpenAI Python SDK 3.41.0: api, accept typed references in Realtime response inputs (#4189) (8ecb487)
- @cloudflare/runtime-types@0.1.18
- @cloudflare/vitest-plugin@1.4.10
- wrangler@4.155.0
- Pulumi 3.273.0: [auto] Add up to the generated automation APIs for NodeJS, Python and Go #25055
- Goose 1.57.0: Allowlist, require HTTPS and validate redirects, block on policy failure #12619
- 1.144.0
- @ai-sdk/workflow-harness@1.0.167
New Repos & Packages
37 pieces, the newest 8 here.
Watch
45 pieces, the newest 6 here.
- API credits, now in ChatGPT Pro and Business plans
- Integrate your app with the Android intelligence system
- Inside BFCM 2026
- Opening keynote: building the next era of software at GitHub Universe 2026
- LF Live Maintainer Session: My Life as a Linux Kernel Developer and Maintainer with Mimi Zohar
- The latest in Android dev tools from Android Dev Summit 2026
Package releases
122 from the most used packages' own repositories, the newest 15 here.
- react-resizable-panels 4.15.1 · every release →
- python-engineio v4.15.1 · every release →
- checkov 3.4.0 · every release →
- sass 1.107.0 · every release →
- pipenv v2026.10.4 · every release →
- pydeck v9.4.1 · every release →
- openfeature-provider-posthog-v0.1.130 · every release →
- gcp-metadata observability-v0.1.0 · every release →
- @opentelemetry/core semconv/v1.44.0 · every release →
- azure-core azure-communication-callautomation_1.6.1 · every release →
- phpstan/phpdoc-parser 2.4.0 · every release →
- google/grpc-gcp v0.5.0 · every release →
- eventsource v5.1.4 · every release →
- temporalio 1.35.0 · every release →
- google-auth google-api-core-v2.43.1 · every release →