Tech news, November 7, 2026
Saturday: 113 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.
The morning briefing
As the paper printed it on /brief/ at 08:46 UTC, in the sources' own words.
- LeadGiving Back to the Open Source We Build On
LanceDB adds ASOF join support to Apache DataFusion, improving time-series joins while giving back to the open source projects we rely on.
- NewsWhat’s new with Google Cloud
Want to know the latest from Google Cloud?
- NewsNavigating the volatile silicon market: updates on memory and storage pricing
Updated on November 6th, 2026 We’ve been able to keep DDR5 pricing stable for the last few months by buffering inventory.
- Outage[Block Storage] - fr-par-1 - Write latency increase due to background operations
Since 22h UTC, mean write latencies slowly increased on one Block cluster on fr-par-1 due to background operations pilling up overnight until 05h19 UTC.
- SecurityRe: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by theknell on Nov 06 Jacob — you asked whether it even entirely works when there is no salt to borrow.
- Deadlinegemini-3.6-flash shuts down in 12 days
Replacement: gemini-3.8-flash.
News
13 pieces.
- We organized Sustainability Month. Here’s what we learned.
What do Kubernetes resource allocation, eBPF, carbon observability, and GPUs have in common?
- November 07, 2026
Google SecOps SOAR Announcement Release 6.3.105 is now available for all regions.
- Progress Report: Linux 7.3
Well here we are again.
- Copilot code review: API management and review overview updates
You can now manage GitHub Copilot code review settings through the REST and GraphQL APIs, from enterprise policy down to individual repositories.
- We Said We Would. Then We Did.
CoreWeave CEO Michael Intrator reflects on 2025: post-IPO scale, global expansion, platform innovation, performance leadership, and powering AI at production scale.
- Managed Deep Agents v0.10: Browser Use and Async Subagents
Managed Deep Agents v0.10 adds browser use, so agents can work on sites with no API and hand you the window to sign in, and async subagents for background work.
- DeepSeek V4.1 Flash 1017 Ultrafast now available on AI Gateway
DeepSeek V4.1 Flash 1017 Ultrafast is now available on AI Gateway through Fireworks.
- AgensGraph 2.18 Released: Graph Database on PostgreSQL 18 with Expanded ISO GQL Support
The AgensGraph Development Team is pleased to announce the release of AgensGraph v2.18.6.1, the latest version in the 2.18 series.
- Brume: FK-safe pseudonymization for PostgreSQL test and debug copies
Brume 2.1, an open source (Apache 2.0) tool that creates deterministic, foreign-key-safe pseudonymized copies of PostgreSQL databases for testing, debugging and demos, is now avai…
- HeapDeck: an on-call monitor for PostgreSQL on iPhone and iPad
HeapDeck is a new native app for engineers on call for PostgreSQL 13 to 19, on the App Store for iPhone and iPad.
- PG Observability Map 1.0.0 Released
We are pleased to announce the initial release (1.0.0) of PG Observability Map, a interactive web-based tool designed to visualize and explore PostgreSQL observability, metrics, a…
- Broadcast text messaging: What is it & how to use it
Broadcast text messaging sends one SMS to your whole list as private, individual texts.
- Preact Website Design Competition Winners
We are excited to announce the winners of the Design Competition!
New Models
1 piece.
- Open model: adventists-ai/Sophon-Realtime-v1
Trending on the Hugging Face Hub.
Security Desk
15 pieces, the newest 10 here.
- [Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie
There is a MEDIUM severity vulnerability affecting CPython.
- CVE-2026-123776: RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process
Posted by Robert Rothenberg on Nov 07 ======================================================================== CVE-2026-123776 CPAN Security Group ================================…
- CVE-2026-121265: SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update
Posted by Robert Rothenberg on Nov 07 ======================================================================== CVE-2026-121265 CPAN Security Group ================================…
- Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by theknell on Nov 07 Following up on my measurements post from last night.
- Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Richard Kettlewell on Nov 07 https://github.com/besser82/libxcrypt/blob/develop/lib/util-make-failure-token.c Pedantically: the result will be "*" if the buffer is only…
- Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by theknell on Nov 06 Jacob — you asked whether it even entirely works when there is no salt to borrow.
- Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Jacob Bachmeyer on Nov 06 Does it even entirely work?
- Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by theknell on Nov 06 Said I'd figure it out, so here we go.
- Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Matt Johnston on Nov 06 I view avoiding account existence exposure as more of a privacy feature than security.
- ARTEX abuse expands as cybercriminals target financial sector
In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.
Technical Guides
4 pieces.
- Python Project Structure: How to Choose the Right Layout
Learn how to structure Python projects: pick between flat and src/ layouts, organize your code, and apply the patterns to CLI, web, and GUI apps.
- Managing Multiple Python Versions With pyenv
Learn how to use pyenv to manage multiple Python versions, prevent conflicts, and keep your projects compatible and development smooth.
- Thonny: The Beginner-Friendly Python Editor
Learn how to use Thonny, the free Python IDE built for beginners, to write, run, and debug your code with its step-by-step debugger.
- Absolute vs Relative Imports in Python
Compare Python relative imports with absolute imports, weigh the pros and cons of each, and learn best practices for writing clean import statements.
Columns
5 pieces.
- We Visited China’s Stargate in Inner Mongolia
A wind-powered 800MW campus, 120MW built within a year, a 5MW SST-native 800V DC pilot and a cooling design without central chillers
- Writing as a thinking tool
In middle school I could not get through long passages no matter how hard I tried.
- [AINews] Anthropic IPO: Whither Now?
November 6, 2026 — ARC Prize tests Inkling 2 Small, and Thinking Machines explains how it caught early checkpoints bypassing guardrails.
- Working with designers
I love working with designers, in part because (unlike managers and product managers) they’re culturally different from engineers.
- Why the bottleneck to AI progress may be human dignity
There aren't many bets I'd take against scaling curves, but one of them is the human ego
Research
5 pieces.
- FeatOutline: Feature-Oriented Repository Summarization for Enhanced Code Comprehension and Maintenance
Repository-level code summaries are typically organized around directories and files, making functionality that spans multiple artifacts difficult to see and trace to its implemen…
- Enhancing Neural Code Representation With Additional Context
Automated program comprehension underpins many software engineering tasks, from code summarisation to clone detection.
- To See is Not to Master: Teaching LLMs to Use Private Libraries for Code Generation
Large Language Models (LLMs) have shown strong potential for code generation, yet they remain limited in private-library-oriented code generation, where models are expected to gen…
- Knowledge Graph-based Retrieval-Augmented Generation for Schema Matching
Traditional similarity-based schema matching methods fail to resolve semantic ambiguities and conflicts in complex, domain-specific mappings due to a lack of commonsense and domai…
- A Survey on Robust Sequential Recommendation: Fundamentals, Challenges, Taxonomy, and Future Directions
Sequential recommender systems (SRSs) have become essential for modeling users’ evolving preferences and supporting personalized information filtering.
Releases
16 pieces, the newest 12 here.
- 1.108.3 (LTS)
- @ai-sdk/zai@3.0.49
- @ai-sdk/xai@5.0.40
- @ai-sdk/workflow-harness@1.0.176
- ai 7.0.165
- v2026.11.4: zip:: includes for config and tasks
- FastAPI 0.162.2: FastAPI includes an official skill that helps coding agents use new features and recommended patterns for…
- mise-daemons-v2026.11.4
- FastAPI 0.162.1: Add parameter model guidance to the FastAPI skill. PR #16693 by @tiangolo
- b12183: opencl: add arange (#31829)
- Hono 4.13.17: fix(cookie), match the Secure- and Host- prefixes case-insensitively in #5608
- langchain 1.6.3
New Repos & Packages
19 pieces, the newest 8 here.
Watch
3 pieces.
Package releases
32 from the most used packages' own repositories, the newest 15 here.
- zip v9.4.2 · every release →
- wcmatch 12.0.1 · every release →
- parse5 v8.1.1 · every release →
- bracex 3.2.2 · every release →
- office365-rest-python-client v3.3.1 · every release →
- nodemailer v10.4.0 · every release →
- spomky-labs/otphp 11.5.1 · every release →
- pypdfium2 5.15.1 · every release →
- flat-cache 2026-11-07 · every release →
- @azure/abort-controller @azure/core-xml_1.6.1 · every release →
- datamodel-code-generator 0.91.0 · every release →
- amphp/process v2.1.2 · every release →
- phpmailer/phpmailer v7.2.0 · every release →
- watchpack v2.6.4 · every release →
- mkdocs-material 9.8.1 · every release →