Tech news, November 14, 2026

Saturday: 38 pieces the paper read from primary sources, by section, newest first. Each links to its source; the line under it is the source's own opening.

The morning briefing

As the paper printed it on /brief/ at 08:46 UTC, in the sources' own words.

LeadWhat’s new with Google Cloud
Want to know the latest from Google Cloud?
Google Cloud
NewsApache Spark vs Apache Flink: which should you use?
For most teams, Apache Spark™ is the better choice.
Databricks
NewsCoreWeave delivers another industry first: End-to-end automated user provisioning for Slurm clusters
Accelerate cluster access with AUP and SUP.
CoreWeave
OutageRed Hat updating our system certificates and keys
We are updating our system certificates and keys.
Quay.io
SecurityCVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 9.1 (critical) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Red Affected versions:…
oss-security (Openwall)
Deadlinegemini-3.6-flash shuts down in 5 days
Replacement: gemini-3.8-flash.
Google Cloud (Vertex AI)

News

2 pieces.

Databricks07:02 UTCApache Spark vs Apache Flink: which should you use?
For most teams, Apache Spark™ is the better choice.
CoreWeave00:37 UTCCoreWeave delivers another industry first: End-to-end automated user provisioning for Slurm clusters
Accelerate cluster access with AUP and SUP.

Security Desk

8 pieces.

oss-security (Openwall)06:00 UTCCVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 9.1 (critical) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Red Affected versions:…
oss-security (Openwall)05:58 UTCCVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 2.3 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Green Affected versions: - Apach…
oss-security (Openwall)05:56 UTCCVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 2.3 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Green Affected versions: - Apach…
oss-security (Openwall)05:06 UTCCVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 5.9 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber Affected versions:…
Chrome Releases05:00 UTCStable Channel Update for ChromeOS / ChromeOS Flex
M-156, ChromeOS version 16836.33.0 (Browser version 156.0.8078.102）has rolled out to ChromeOS devices on the Stable channel.  If you find new issues, please let us know one o…
oss-security (Openwall)04:53 UTCCVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 6.3 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Amber Affected versions: - Ap…
Huntress01:50 UTCAttackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers
Fake crypto exchange sessions are showing up on ScreenConnect servers and could be bait for technicians.
Qubes OS00:00 UTCQSB-124: Partial filtering bypass in split-gpg2
We have published Qubes Security Bulletin (QSB) 124: Partial filtering bypass in split-gpg2.

AI in the Field

1 piece.

npj Digital Medicine00:00 UTCBeyond skin deep: physiologic oral pigmentation as an overlooked validation gap in AI-assisted oral cancer screening
npj Digital Medicine, Published online: 14 November 2026; doi:10.1038/s41746-026-03466-9 Beyond skin deep: physiologic oral pigmentation as an overlooked validation gap in AI-assi…

Columns

1 piece.

swyx (Latent Space)08:31 UTC[AINews] The No AI Slop Manifesto
November 13, 2026 — AIE speakers unite to lay out how to fight slop.

Releases

11 pieces.

llama.cpp08:46 UTCb12376
ClickHouse08:12 UTCRelease v26.3.63.123-lts
Goose06:50 UTCGoose 1.59.1: macOS desktop builds and full release notes coming soon
ONNX Runtime06:34 UTCONNX Runtime CUDA Plugin EP 0.4.0
llama.cpp04:18 UTCb12375
LangGraph01:43 UTClanggraph==1.2.22
LangGraph01:39 UTClanggraph-checkpoint-postgres==3.2.1
LiteLLM00:51 UTCLiteLLM 1.106.10: Verify this release
Cypress00:36 UTCchore: release @cypress/webpack-dev-server-v6.2.0
llama.cpp00:12 UTCb12374
DeepSpeed00:08 UTCnightly-cpu-multi-last-green: [Ulysses] Add opt-in uneven-shard rejection and FPDT padding (#9059)

New Repos & Packages

6 pieces.

npm #llm08:12 UTCtypia 15.4.1
npm #llm08:07 UTC@typia/utils 15.4.1
npm #llm07:40 UTCtokenx 2.2.1
npm #ai-agent07:28 UTCinstar 1.3.1768
npm #ai-agent04:30 UTC@michengai/dsh-skills-manager 1.4.7
GitHub #developer-tools00:46 UTCbriskember13/adobe-acrobat-pdf-desktop (225 stars)

Watch

1 piece.

GitHub · YouTube07:15 UTCMeet Valkey | Open Source Friday

Package releases

8 from the most used packages' own repositories.

08:24 UTCbrowser-use 1.0.5 · every release →
06:04 UTClucide-react 1.73.0 · every release →
03:46 UTCdiff-cover v11.0.2 · every release →
02:23 UTCtemporalio 1.36.1 · every release →
02:11 UTCcyclopts v5.5.0 · every release →
02:01 UTC@asamuzakjp/dom-selector v10.0.6 · every release →
00:43 UTC@cloudflare/workerd-linux-64 v1.20261114.1 · every release →
00:23 UTCplaywright v1.65.2 · every release →