Tech news, November 2, 2026
Monday: 553 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
The morning briefing
As the paper printed it on /brief/ at 08:46 UTC, in the sources' own words.
- LeadAPRICOT 2027 registration is now open, with discounts for APNIC Members
Registration for the APRICOT 2027 Summit, being held from 24 February to 4 March 2027 in Hong Kong SAR, China, is now open.
- NewsNew Bug-Fix Releases for MPS Versions 2026.2 RC2, 2026.1.2, 2025.3.3, 2025.2.5, and 2025.1.5
We’ve released updates for multiple MPS versions that fix a critical security issue.
- NewsGame Off 2026: The theme is SHIFT
GitHub’s annual month-long game jam is back for its 14th year!
- OutageSilent Network Authentication (SNA) Missing Redirects in Indonesia
Twilio customers may be experiencing device verification timeouts during API transactions for Silent Network Authentication (SNA) in Indonesia.
- SecurityA week in security (October 26 – November 1)
A list of topics we covered in the week of October 26 to November 1 of 2026
News
147 pieces, the newest 20 here.
- Managed Deep Agents: the fastest way to ship a production deep agent
Run deep agents in production with durable execution, sandboxes, tool access, and LangSmith observability, without building the runtime yourself.
- Client-side threat detection: how Scareware blocker uncovered malicious notification abuse
Website notifications were designed to help us stay informed.
- Your First Performance Test in Postman: A Quick Guide
Run your first performance test in Postman by reusing an existing collection.
- Introducing queue consumption mode for Apache Kafka in AWS Lambda
AWS Lambda event source mappings now support queue consumption mode for Apache Kafka.
- Fixes available in -proposed pocket for CVE-2026-98432
Fixes for the CVE-2026-98432 Linux kernel vulnerability are available for Ubuntu.
- Projects can now be configured with vercel.toml
Vercel now supports vercel.toml, which allows you to to configure your project using the TOML configuration format.
- CVE-2026-98432: A Remote Use-After-Free in the Linux Kernel's TCP Stack
Learn about CVE-2026-98432, a critical remote use-after-free flaw in the Linux kernel TCP stack, its root exploit risks, affected versions, and mitigation steps.
- The Platform Behind the Next AI Breakthrough
The next frontier of AI is coming into focus as agents take on longer, more strategic work.
- Vivaldi Mobile 8.3 RC 2 – Vivaldi Android Browser snapshot 4192.23
Today’s Snapshot is the second release candidate for Vivaldi Mobile 8.3 release on Android.
- Haiku 5.5 now available on Kiro in AWS GovCloud (US)
A new Anthropic model is now available in the Kiro IDE and CLI for the AWS GovCloud (US) Regions.
- New context engineering challenges in late 2026
LangChain CEO Harrison Chase shares insights into the biggest harness engineering challenges with the emergence of proactive agents.
- Making AI measurable: How I think about the value of AI initiatives
A simple framework for tying AI initiatives to the business metrics they’re supposed to move.
- Vercel MCP now supports Client ID Metadata Documents
Any MCP client can now ask to connect to Vercel MCP.
- [In preview] Public Preview: On-prem NAS share discovery and assessment are now available using Azure Migrate
Azure Migrate now supports discovery and assessment for network-attached storage, allowing customers and partners to plan migrations of Dell PowerScale (OneFS) and NetApp ONTAP st…
- Build an AI Wellbeing App with Fireworks and Fitbit via Auth0 Token Vault.
Build Daily Wellbeing, a Next.js app that connects Fitbit through Auth0 Token Vault, compares your daily activity and sleep with your averages, and uses Fireworks to suggest what…
- Retirement: OT security in Microsoft Defender for IoT
This is the formal notice that Microsoft plans to deprecate the operational technology (OT) security component of Microsoft Defender for IoT.
- [Launched] Generally Available: Change from virtual network integration to a private endpoint capable network configuration in Azure Database for PostgreSQL flexible server
You now have greater flexibility in network design for Azure Database for PostgreSQL Flexible Server workloads.
- Retirement: Azure Fluid Relay
On February 2, 2027, we will retire Azure Fluid Relay.
- Amazon RDS now supports per snapshot billing
Starting today, Amazon RDS supports per snapshot billing for Amazon RDS snapshots.
- Amazon Quick on desktop now uses your organization's existing Amazon Quick sign-in
For organizations that use Amazon Quick, the desktop application now signs users in with the same sign-in method the organization already uses for Quick on the web.
New Models
2 pieces.
- New model: Z.ai: GLM 5.3 FlashX Legal
GLM-5.3-FlashX-Legal (GLM-Legal) is Z.ai's legal-domain variant of GLM-5.3-FlashX, a native multimodal model that accepts text, image, and video input and produces text.
- Open model: moonshotai/Kimi-K3.1-Pro
Trending on the Hugging Face Hub.
Security Desk
56 pieces, the newest 10 here.
- Unit 42 Threat Intelligence Highlights - Nov. 2, 2026
Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows.
- Re: OATH Toolkit PSKC Signature Verification bypass in libpskc (CVE-2026-109117)
Posted by Simon Josefsson on Nov 02 FYI - also via https://oath-toolkit.codeberg.page/CVE-2026-109117.html /Simon Simon Josefsson via OATH Toolkit general discussions <oath-toolki…
- CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635.
- CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulne…
- What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Real-world exploitation concentrates in a small, high-impact subset of CVEs.
- Subnet Solutions PowerSYSTEM Center
Subnet Solutions PowerSYSTEM Center mstradling Nov 02, 2026 Release Date November 03, 2026 Description View CSAF Summary Successful exploitation of these vulnerabilities could all…
- CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-wo…
- CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 - Apache Syncope…
- CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 - Apache Syncope…
Technical Guides
16 pieces, the newest 10 here.
- Diagnose Distributed AI Workload Failures with NVIDIA Attribution
In distributed AI workloads, a single error can produce a cascade of symptoms.
- Keep Distributed Training Running with Automated Workload Recovery
As distributed AI training scales, failures across hardware and software dependencies increasingly disrupt training progress, making fast, reliable recovery...
- Extending AWS DevOps Agent with Skills, Model Context Protocol (MCP) Servers, Custom Agents and Connectors
AWS DevOps Agent investigates incidents, traces problems from code to cloud, and analyzes Amazon CloudWatch, AWS CloudTrail, and third-party observability tools out of the box.
- Making Kubernetes AI-Ready for NVIDIA Vera Rubin on Day One
Configuring and optimizing Kubernetes for new GPU hardware such as NVIDIA Vera Rubin is complex and error-prone.
- Google Cloud Developer plugin now available in Antigravity Marketplace
Building cloud solutions with autonomous AI agents should feel fast, safe, and reliable.
- DigitalOcean Serverless Inference latency: p50, p95 and p99 TTFT for GLM-5.3, DeepSeek V3.2, Gemma 4 and Llama 4 Maverick (3,456 requests, 48 hours)
p50, p95 and p99 TTFT and tokens per second for GLM-5.3, DeepSeek V3.2, Gemma 4 and Llama 4 Maverick on DigitalOcean Serverless Inference, over 48 hours.
- Prepare web content for Amazon Bedrock Knowledge Bases with Crawl4AI
This post shows how to use Crawl4AI, an open source web crawler, as a content preparation layer for Amazon Bedrock Knowledge Bases, handling JavaScript rendering, selective extrac…
- Build efficient agents with knowledge distillation on Amazon SageMaker AI
Agentic assistants built on frontier models run a multi-step tool loop, and paying frontier prices on every step is hard to sustain at production scale.
- Agentic engineering intelligence with Amazon Nova Multimodal Embeddings and Amazon Bedrock AgentCore
Learn how to build a multi-agent engineering assistant that compresses aerospace component substitution evaluation from days to minutes, using Amazon Nova Multimodal Embeddings, A…
- How Circle K accelerated DevOps incident triage to under 15 minutes with Amazon Bedrock
Circle K's DevOps team cut incident triage from 45-60 minutes to under 15 by building an agentic triage system on Amazon Bedrock.
AI in the Field
7 pieces, the newest 6 here.
- Powering up for a pivotal moment
From a nuclear revival to qubits, the MIT Energy Initiative’s annual research conference tracked deployment of today’s technologies to discovery of tomorrow’s breakthroughs.
- How BeeAPro ships new features daily on Supabase with a technical team of three
BeeAPro is an Italian training platform for companies in compliance-heavy industries.
- How VideoGen moved 3.3 million users off Firebase with two engineers
VideoGen is an AI-native video creation platform.
- Regina Barzilay and Jim Collins win Pritzker Prize for AI and Science Research Excellence for work in AI-enabled antibiotic discovery
The MIT professors collaborated to identify the first AI-discovered antibiotic, a scientific breakthrough that is widely recognized as a milestone in AI-driven drug discovery.
- AI needs meaningful versioning
Nature Machine Intelligence, Published online: 02 November 2026; doi:10.1038/s42256-026-01323-8 Artificial intelligence (AI) providers frequently update their models and system in…
- AI adoption in Europe
Keynote speech by Philip R Lane, Member of the Executive Board of the European Central Bank, at the Federal Reserve Bank of San Francisco Economic Research Symposium on “AI and th…
Columns
12 pieces, the newest 6 here.
- Building AI for Lawyers - Jacob Lauritzen, CTO of Legora
Evals without traces, million-cell tabular reviews, and cracks in the billable hour as a business model
- Building Legal Agents When You Can't See the Data - Jacob Lauritzen, CTO of Legora
Legora can’t read a single trace of what its agent does for a lawyer.
- Scott Alexander’s Against SURA Seems Deeply Confused
If you are helping build something that might kill everyone, maybe stop doing that.
- Sneaking into the auditorium for the Windows 2000 launch rehearsal
Wait, that's not him.
- Import AI 479: Spacewar; low-latency tasks versus LLMs; Genie 4
Welcome to Import AI, a newsletter about AI research.
- Palaces Of The Crow by Ray Nayler
I really liked Ray Nayler’s The Mountain In The Sea.
Research
158 pieces, the newest 10 here.
- Pixel-UMI: Learning Environment-Aware Whole-Body Manipulation from Sensorized Human Demonstrations
Sensorized human demonstrations offer scalable data for mobile manipulation, but embodiment differences complicate policy learning.
- Pixel: A Co-Designed Full-Stack Robot System for Learning General-Purpose Mobile Manipulation
General-purpose mobile manipulation requires a combination of capable robot hardware, scalable demonstration collection, expressive whole-body control, and effective policy learni…
- EgoActionBench: Benchmarking Dense Action Captioning for Egocentric Human Videos
Learning from human data offers a scalable path toward embodied intelligence, yet it requires models to accurately understand fine-grained human actions from egocentric observatio…
- From Natural Language to Exact Cover: A Neuro-Symbolic Approach to Zebra Puzzles
Chain-of-Thought (CoT) generation has substantially improved the performance of Large Language Models (LLMs) on complex reasoning tasks, including code generation, data analysis,…
- WebHarbor: Docking Real Websites for Evolving GUI Agent Environments
GUI web agents require realistic and interactive environments that remain stable during both evaluation and training.
- Pretraining Data Scale Reverses the Muon-AdamW Fine-Tuning Gap
Muon has recently emerged as a promising optimizer for pretraining large language models, offering a speedup over AdamW in minimizing pretraining loss.
- Supporting Viewpoint Coordination for Compliance by Design with an Artifact Model for Regulatory Requirements Engineering
Regulatory compliance has become an essential software requirement Legal demands for compliance by design CbD call for requirements engineering RE approaches that derive requireme…
- Not All Reasoning Generalizes: A Case Study on Learning Generalizable Reasoning Strategies in RLVR
Reinforcement learning with verifiable rewards (RLVR) can enable generalizable improvement for large language model (LLM) reasoning.
- Isekai3D SDG: A Platform for Diverse Synthetic Gameplay Visual Data
We present Isekai3D Synthetic Data Generation (SDG), a platform for simulating and capturing synthetic 3D gameplay for research in vision and world models, neural graphics, gamepl…
- FADE: Factored Ability--Difficulty Filtering for Online RLVR Scheduling
Group-based reinforcement learning with verifiable rewards (RLVR) learns only from prompts whose sampled completions disagree: all-pass and all-fail groups produce zero relative a…
Releases
37 pieces, the newest 12 here.
- Temporal 1.31.5: Fix security vulnerabilities for 1.31 minor release by @yycptt in #12829
- Temporal 1.32.2: Fix security vulnerabilities for 1.32 minor release by @yycptt in #12831
- Angular 21.2.26: only compile the template contents of a downgraded component
- SGLang 0.5.23: 1007 PRs from 257 contributors
- Angular 20.3.35: only compile the template contents of a downgraded component
- @openrouter/sdk 1.5.34
- Argo CD 3.3.19: kubectl create namespace argocd
- Argo CD 3.5.7: kubectl create namespace argocd
- langchain-anthropic==1.7.9
- oxc crates_v0.157.0
- @anthropic-ai/sdk 1.4.0
- google-cloud-sdk-v1.1.2
New Repos & Packages
34 pieces, the newest 8 here.
Watch
27 pieces, the newest 6 here.
- GitHub Universe 2026 was built different
- The Augmented Forest • Kent Beck• GOTO Copenhagen 2026
- GitLab Artifact Central Demo: Scaling DevOps for the Agentic Era
- Black Hat Europe 2026 | Welcome Video
- Grafana Assistant Demo: AI-Powered Root Cause Analysis and Remediation
- How Uber Optimizes Code at Scale with Grafana Cloud Continuous Profiling & Grafana Assistant
Package releases
57 from the most used packages' own repositories, the newest 15 here.
- gcp-metadata bigquery-v9.6.0 · every release →
- grpcio v1.83.2 · every release →
- checkov 3.4.3 · every release →
- @azure/abort-controller @azure/arm-postgresql-flexible_10.0.0 · every release →
- tox 4.67.7 · every release →
- zircote/swagger-php 7.1.0 · every release →
- jsonpointer v3.8 · every release →
- holidays v0.108 · every release →
- clean-stack v7.0.0 · every release →
- ddtrace v4.16.2 · every release →
- serialize-error v13.1.0 · every release →
- p-retry v9.0.0 · every release →
- openfeature-provider-posthog-v0.1.140 · every release →
- @tanstack/query-core release-2026-11-02-2039 · every release →
- p-timeout v8.1.0 · every release →