September 19 – 25, 2026
Saturday to Friday, Brasília time.
- 1,796pieces
- 334sources
- 38new models
- 10exploited vulnerabilities
- 30major incidents
The Week's Top Stories
What mattered most, each in its maker's or first source's words.
-
1
Claude Opus 5.5
We've launched Claude Opus 5.5 (claude-opus-5-5), a model for long-running agentic coding and knowledge work. It has a 1M token context window by default, 128k max output tokens, and always-on adaptive thinking, at $4 /…
Also reported by AWS Machine Learning · Vercel · Netlify · What's New with AWS · Microsoft Azure · Snowflake
-
2
Released GPT-6 Sol (gpt-6-sol) and GPT-6 Luna (gpt-6-luna).
Feature · gpt-6-sol · gpt-6-luna · v1/responses · v1/chat/completions. Released GPT-6 Sol (gpt-6-sol) and GPT-6 Luna (gpt-6-luna). These reasoning models accept text and image inputs and generate text through the Respons…
Also reported by OpenAI · Vercel · AWS Machine Learning · What's New with AWS · Netlify · Microsoft Azure
-
3
Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS generally available (GA)
Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS generally available (GA): Released our next-generation text-to-speech (TTS) audio models and the Gemini API Voices endpoint (/v1beta/voices): Gemini 3.8 Flash TTS (gemin…
Also reported by Google DeepMind · Vercel · Google Cloud
-
4
Grok 4.7
Grok 4.7, SpaceXAI's frontier model for coding, agentic tasks, and knowledge work, is now available on the xAI API as grok-4.7. It has a 500k context window, text and image inputs with text-only output, and no text outpu…
Also reported by Vercel
-
5
Cache diagnostics is out of beta on the Claude API and no longer requires the cache-diagnosis-2026-04-07 beta header.
Cache diagnostics is out of beta on the Claude API and no longer requires the cache-diagnosis-2026-04-07 beta header. Include the diagnostics object on a Messages request to opt in; requests that still send the header wo…
-
6
Designing agent-first platforms: What changes when agents do the work
The organizations pulling ahead are not simply adding AI to what they already have. They are designing for a different kind of software. The post Designing agent-first platforms: What changes when agents do the work appe…
-
7
Confused Deputy: The Old Bug That AI Agents Keep Reintroducing
A category of vulnerability we aimed to eradicate is re-emerging with the rise of AI agents.
-
8
Build your way: Use any AI agent of your choice in Android Studio
Posted by Matthew Warner, Product Manager, Android Developer Experience AI-powered developer tools have become an essential multiplier for engineering productivity, with teams adopting specialized AI coding agents, custo…
Security
Vulnerabilities newly known to be exploited (CISA), then the week's most relevant advisories.
- CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a cr…
- CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitatio…
- CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote c…
- CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to uploa…
- CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to exe…
- CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.
- CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to…
- CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
- CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directorie…
- MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromi…
- Critical: [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
Affects mcp-atlassian. CVE-2026-77244.
- Critical: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Affects decepticon-core, decepticon, decepticon-sdk. CVE-2026-61732.
- What’s in the SOSS? Podcast #73 – S3E25 Securing the Source: Navigating AI Velocity, CRA Compliance, and Dependency Debt with Abby Kearns
In this episode of What’s in the SOSS, ActiveState CEO Abby Kearns breaks down the rapidly evolving open source security landscape. The conversation explores why reactive post-build scanning fails, the risks of AI-driven…
- Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Major Incidents
Outages the providers themselves rated major or critical.
- Kimi K3 Model API outage
- Errors accessing Netlify-hosted sites
- Confluent Cloud Console Degraded (All Regions) and Multiple Services Impacted in AWS us-west-2
- Elevated inference 500s for a subset of models deployed in GCP central1
- Elevated rate of failed iOS submissions
- Elevated rate of failed iOS submissions
- Elevated errors for multiple models
- Aura-2 TTS Elevated Error Rates for English Voices
- Elevated error rates in Azure Germany West Central region
- [Serverless][AWS][eu-west-1] 5xx on read requests
- Increased error rate in project creation and project restore
- Confluent Cloud Console Degraded (All Regions) and Multiple Services Impacted in AWS us-west-2
- Upstash unavailability in FRA region
- Degraded Performance: Cloud Provisioning Delays
- Elevated private networking errors
- HCP Terraform Returning 404s
- Partial Sprites outage
- Age group status mismatch across devices
- Elevated inference 500s for a subset of models deployed in 1 US-East cluster
- Permission errors in the Supabase Dashboard
- Private Networking issues (6PN)
- Project Lifecycle Issues in eu-west-1
- State database issues in GRU
- Error accessing Netlify-hosted sites
- Partial Service Disruption
- Build and deploy failures in Oregon
- Data Irregularities for US region
- Issues with Codex
- INC20000237
- Users unable to access releases.hashicorp.con
Releases
Major and minor versions only — no patches.
- 22.2.0
compiler Commit Description allow template to access private props do not encapsulate nested selectors if parent contains::ng-deep scope nested CSS rules compiler-cli Commit Description add strictUnclaimedEventNames opti…
- VSCode Extension: 22.2.0
fix(vscode-extension): Support inlay hint in inline templates ( c11920da48 ) fix(vscode-extension): provide folding ranges for templates with interpolated strings ( 5c927fba0d ) fix(vscode-extension): handle template lit…
- v1.8.0
1.8.0 (2026-09-22) Full Changelog: v1.7.0...v1.8.0 Features api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) ( b5cc700 ) Bug Fixes api: share one evaluated_permission enum ac…
- 3.4.0
DSPy 3.4.0 DSPy 3.4 introduces Jev integration through TypeSafe, with three experimental decision types— Noul, Choice, and Score —that bring probability evidence into ordinary DSPy signatures. ReAnchor calibrates those d…
- Release v0.61.0
What's Changed Changelog for v0.60.0-preview.0 by @gemini-cli-robot in #29251 chore(release): bump version to 0.61.0-nightly.20260908.gc647533d6 by @gemini-cli-robot in #29254 Changelog for v0.59.0 by @gemini-cli-robot i…
- v2.25.0
2.25.0 (2026-09-22) Features Add sample_audio to Voice in GAOS SDK ( a011633 ) Add Voices API resource to GAOS SDK ( c45b94e ) Expose SpeechMetadata, VoiceConfig.voice, and SpeechAnnotation in public GenAI SDKs ( a6d3243…
- v1.52.0
✨ Features Live voice conversations in the desktop app #12093 Decisions provider crate with OpenRouter and Jev implementations #12418 Z.AI Coding Plan provider with streaming tool calls #12205 Recipe parameter limits enf…
- v13.33.0
[13.x] Drop restart_syscalls from pcntl_signal in Worker by @jackbayliss in #61590 Adjust when password hash is stored for authenticated sessions by @taylorotwell in #61594 [13.x] Ability to opt out of killing the worker…
- v12.1.0
v12.1.0 (2026-09-23) Bug fixes core #17838 fix(core): inherit optional ctor params when the ctor is not redeclared ( @kamilmysliwiec ) #17819 fix(core): name the module when metadata entries are invalid ( @thekhegay ) mi…
- 2026-09-22, Version 26.10.0 (Current), @aduh95
Notable Changes [ c0a42d23e5 ] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627 [ eb4fabe81e ] - doc: add araujogui to collaborators (Guilherme Araújo) #66090 [ 64fb33d791 ] - (SEMVER-MINOR)…
- ONNX Runtime WebGPU Plugin EP v0.4.0
This release brings kernel performance improvements, expanded operator support, and reliability fixes to the ONNX Runtime WebGPU Plugin EP. Highlights Performance Optimized MatMulNBits wide-tile execution using subgroup…
- v0.40.0
What's Changed Models run on MLX on Apple Silicon by default In this release, on Apple Silicon devices, model architectures supported by the MLX runtime will automatically run on MLX. ollama pull qwen3.8 ollama run qwen3…
- 0.157.0
New Features Added GPT-6 Sol and Luna, including Amazon Bedrock support and migration prompts for older models. ( #47332, #47347 ) Enabled fullscreen transcripts by default and added Shift-click to extend text selections…
- v7.22.0
7.22.0 (2026-09-22) Features api: add GPT-6 Sol and Luna model identifiers ( #2790 ) ( cff2135 )
- v7.23.0
7.23.0 (2026-09-23) Features api: add GCP external storage support ( #2794 ) ( 7cd0629 ) api: add GPT-Rosalind research model ( #2792 ) ( d0e6fcd ) Chores api: document exact Chat Completions seed bounds ( #2796 ) ( 13b8…
- v3.17.0
3.17.0 (2026-09-22) Features api: add external storage configuration management ( #3909 ) ( 6332577 ) api: add safety case retrieval ( #3911 ) ( a87b938 ) api: add safety warning and deactivation webhook events ( #3908 )…
- v3.18.0
3.18.0 (2026-09-22) Features api: add GPT-6 Sol and Luna model identifiers ( #3935 ) ( 455ce1b )
- v3.19.0
3.19.0 (2026-09-22) Features api: add GCP external storage support ( #3943 ) ( d12d60f ) api: add GPT-Rosalind research model ( #3940 ) ( d041d73 ) Bug Fixes _utils/_transform: propagate api_exclude in _async_transform_r…
- oxlint v1.85.0
🚀 Features 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode ( #26763 ) (leaysgur)
- oxfmt v0.70.0
🚀 Features 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode ( #26763 ) (leaysgur)
- 2.5.0
Added Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall ( #10931 ). Add official support for Python 3.15 ( #11046 ). Changed Do not send creden…
- v0.315.0
v0.315.0
- 3.15.0 / 2026-09-24
[CHANGE] PromQL: A range query whose end was not aligned to step caused subqueries inside it to evaluate past the parent's last actual step, inflating peakSamples in the query stats and against the query.max-samples limi…
- v3.264.0
3.264.0 (2026-09-23) Features [sdk/python] Add component state migration callbacks to ResourceOptions #24331 [cli/deployment] Allow pulumi deployment settings edit to configure git authentication, dependency caching, tem…
- pkg/v3.264.0: Changelog and go.mod updates for v3.264.0 (#24753)
Co-authored-by: github-actions github-actions@github.com
- sdk/v3.265.0: Authenticode-sign Windows binaries in release builds (#24785)
Part of IAC-4046 None of the.exe files we ship for Windows have ever been Authenticode-signed. Only the winget MSI container is, and it wraps the same unsigned zip. Defender is now quarantining pulumi-language-bun.exe as…
- v3.265.0
3.265.0 (2026-09-25) Features [cli/auth] Add pulumi logout --all --delete-credentials-key to delete the key that encrypts stored credentials from the OS credential store #24764 Bug Fixes [programgen/python] Generate vali…
- pkg/v3.265.0: Changelog and go.mod updates for v3.265.0 (#24914)
Co-authored-by: github-actions github-actions@github.com
- viable/strict/1790249252: Revert "[CI] Update sccache to 0.18.0 (#198237)"
This reverts commit 2954159. Reverted #198237 on behalf of https://github.com/jansel due to Breaks every trunk build that compiles torchao: inductor-build-cuda134 and torchtitan-x-pytorch-build have been red on all 22 co…
- viable/strict/1790321594: [Dynamo] Port CPython 3.13 test_fnmatch (#197389)
Description This PR ports test_fnmatch.py from CPython 3.13 to PyTorch Dynamo as part of tracking issue #196238. The two tests requiring Dynamo engine support ( test_bytes and test_mix_bytes_str ) are skipped with @unitt…
- viable/strict/1790353884: Skip `TestFullyShardSymmMem` for NCCL < 2.28 (#184536)
NCCL_CTA_POLICY_ZERO was introduced with NCCL 2.28 so skip that test similar to NCCLCopyEngineCollectives. Pull Request resolved: #184536 Approved by: https://github.com/Skylion007
- v4.2.0-M2
⭐ New Features Deprecate AppOptics as it has retired #51810 Improve classpath entry lookup performance during jar creation and extraction #51787 Add spring.kafka.listener.await-async-results-on-stop property #51774 Ratio…
- v4.2.0-M1
⭐ New Features Refine Forwarded headers configuration for Jetty servers #51148 Disable Micrometer global registry in tests by default #51142 Use GracefulHandler rather than StatisticsHandler to coordinate graceful shutdo…
- v2.118.0
2.118.0 (2026-09-25) This release introduces new workflow commands ( pull, notebooks, whoami ), experimental stack management commands, and fixes numerous stability issues across the CLI and stack runtime. Highlights New…
- v1.14.0
Features trl.losses is gone: DPO, KTO and GRPO stream their own log-probs Warning from trl.losses import FusedLinearDPOLoss (or FusedLinearKTOLoss, FusedLinearGRPOLoss, FusedLinearJSDLoss ) no longer works. The module in…
- 1.139.0
https://code.visualstudio.com/updates/v1_139
- v1.21.0
This week's release includes faster rendering in syntax-highlighted files and Markdown code blocks, a language server command picker, a setting that keeps your system awake during long-running agent turns, and BYOK suppo…
- v0.5.0
Overview This release focuses on backend performance and correctness, broader model coverage, and more robust server/router operation. It adds HRM-Text (DFM Mimir 1B) support, MiMo-V2.6 and HunyuanOCR conversion support,…
- @google/genai 2.24.0
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…
- @anthropic-ai/sdk 0.128.0
The official TypeScript library for the Anthropic API
- openai 7.23.0
The official TypeScript library for the OpenAI API
- pnpm 12.6
pnpm 12.6.0 ships with automatic dependency deduplication, relocatable node_modules, package.yaml manifest editing, and --save-types support. Minor Changes autoDedupe deduplicates compatible dependency versions during in…
- pnpm 11.28
pnpm 11.28.0 adds the forceIgnoresPlatform setting and pnpm update --peer, and fixes many bugs in pnpm deploy, --filter, nodeLinker: hoisted, and custom modulesDir setups. This release also carries security fixes for she…
- pnpm 12.7
pnpm 12.7.0 ships with.nvmrc and.node-version support in the global node shim, pnpm install --allow-build, pnpm publish --publish-wait-timeout, and pnpm-workspace.yaml created from the workspaces field. pnpm install --fo…
- v0.30.0
v0.30.0 Highlights This release features 762 commits from 315 contributors (104 new)! New models: DeepSeek-V4.1-Flash ( #56214, #56228, #56208 ) with the whole KV stored in MXFP8 through the FlashMLA V4.1 record on SM100…
Research
The papers most useful to a developer this week.
- ChunkRank: Model-Aware Text Chunking and Abstention-Aware Answer Selection for LLM Pipelines
We present ChunkRank, an open-source Python library that derives chunk boundaries from a target model's tokenizer and context window, and selects an answer among candidates produced independently per chunk. It ships a validated registry of 90 models across 15 providers and six an…
- LLM Agents Can Easily Tamper With Their Own Traces
Asynchronous monitoring, incident investigations, and compliance audits primarily rely on agent traces to reconstruct what happened. These analyses assume that LLM agents cannot tamper with their own execution traces. We show that local LLM agents such as Claude Code, Codex, Anti…
- To Trust or Not to Trust: Retrieval-Augmented Fact Checking in Speech
Online misinformation increasingly appears in spoken formats such as news clips, podcasts, interviews, political speeches, and social media videos, creating a need for fact-checking systems that can verify claims directly from speech. We introduce VeriSpeak, a probe benchmark for…
- Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure
A central concern in AI safety is that agents may treat oversight as an obstacle when it conflicts with completing their goals. We study instrumental evasion, the propensity of LLM agents to circumvent runtime monitoring as a means of completing ordinary tasks. We introduce Evasi…
- VietPrism: A large-scale Vietnamese speech and deepfake corpus with diverse dialects and code-switching
Vietnamese speech research is constrained by resources that isolate automatic speech recognition from speaker, dialect, code-switching, and deepfake analysis. We introduce VietPrism, an open, multi-domain corpus that brings these dimensions together at scale: 993.4 hours and 403,…
End of the week.The week after →