October 24 – 30, 2026
Saturday to Friday, Brasília time.
- 3,151pieces
- 929sources
- 27new models
- 10exploited vulnerabilities
- 37major incidents
The Week's Top Stories
What mattered most, each in its maker's or first source's words.
-
1
What’s new with Google Data Cloud
October 26 - October 30 Knowledge Catalog introduces self-learning context enrichment and Knowledge Studio (Preview) Knowledge Catalog's enrichment agent now learns from agent and user interactions and from sources such…
-
2
Introducing GPT-6.1 Terra
Bringing fast and capable computer use to everyone
Also reported by OpenAI API Changelog · Codex Changelog · Vercel · Netlify · What's New with AWS · GitHub Changelog
-
3
Malware Package Analysis: aiocpa
On 2024-11-21, PyPI was notified about a malware attack with few details. Upon further investigation, we found that the maintainer was injecting obfuscated code that will exfiltrate credentials to a specific Telegram bot…
-
4
Into the Omniverse: How Developers Turn Ideas Into Simulations With Frontier AI Agents
Turning a simulation idea into a working application means assembling assets, connecting physics and rendering, and checking that the scene behaves as intended. Developers are combining frontier AI models with NVIDIA Omn…
-
5
What’s new in AI infrastructure and orchestration in October
The Google Cloud AI Infrastructure team had another busy month in October, filled with new product launches and updates to power today’s AI and agentic workloads scalably and efficiently. We were also honored to share ou…
-
6
What’s new with Google Cloud
Want to know the latest from Google Cloud? Find it here in one handy location. Check back regularly for our newest updates, announcements, resources, events, learning opportunities, and more. Tip: Not sure where to find…
-
7
2FA Enforcement for New User Registrations
What's changing? Starting today, newly registered users must enable 2FA before they can perform any management actions on PyPI. This change comes after we've also added a rule for accounts to have a verified, primary ema…
-
8
Enforcement of 2FA for upload.pypi.org begins today
Beginning today, all uploads from user accounts with 2FA enabled will be required to use an API Token or Trusted Publisher configuration in place of their password. This change has been planned since 2FA was rolled out i…
Security
Vulnerabilities newly known to be exploited (CISA), then the week's most relevant advisories.
- CVE-2026-109618: PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
- CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
- CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
- CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or pot…
- CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer co…
- CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regul…
- CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to re…
- CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Th…
- CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-10…
- Cisco Finesse Server-Side Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability…
- CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Posted by Jens Geyer on Oct 30 Severity: important CVSS 4.0: 8.2 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache Thrift (org.apache.thrift:libthrift) before 0.24.0 Descr…
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. The post Inside a malicious Claude Code-branded extension and its persistent SSH backdoo…
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
On October 29, 2026, a trojanized version (2.1.313) of the official Claude Code VS Code extension was published to Cursor's extension marketplace, reaching up to 5,000 Cursor users during an 11-hour window. Sandbox and r…
- Fwd: GNU mtools 4.0.50 released, fixes CVE-2026-118384
Posted by Alan Coopersmith on Oct 30 https://www.cve.org/CVERecord?id=CVE-2026-118384 says "GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c." https://lists.gnu.org/archive/html/info-mtools/20…
Major Incidents
Outages the providers themselves rated major or critical.
- Elevated errors for Claude Fable 5.1
- Service Disruption Impacting Wells Fargo connections
- View package and auth outage on npmjs.com
- Background job processing stalled
- Red Hat Connect Major Outage - Investigating
- Problems with Vitess connectivity and credential changes
- Bandwidth Local Market Impairment - 658 - Colorado Springs, CO
- Elevated Build Errors and Agent Runner failures
- Problems loading application
- Elevated errors for Claude Sonnet 5.5
- API & API CDN timeouts for small subset of customers
- Elevated errors for Claude Sonnet 5.5
- Frontend Observability Outage in prod-eu-west-2
- Kubernetes Cluster Management Operations
- API Service Degradation - EU Region
- Next-Gen Entity Platform Issues
- Studio, Dashboard, Content Agent, & Manage timeouts
- 2026-October-28 Service Incident
- Disruption with some Copilot services
- Delays processing new video uploads
- Elevated Mux Video Errors
- Vietnam - Multiple services degradation
- [fr-par] [Serverless SQL DB] All SQL databases are unavailable
- BitBucket Cloud Integrations Degraded
- Number Portability Checker Incident
- 404s downloading worker binary
- dbt Wizard SQL execution failing
- Bandwidth Local Market Impairment - 658 - Colorado Springs, CO
- SSO Profile API Timeouts
- SMS Delivery Issues
- Delays processing new video uploads
- API errors
- Disruption with GitHub services
- 2026-October-30 Service Incident
- Issues establishing voice calls
- Incident with Actions, Pages, and Webhooks
- Elevated error rates and intermittent failures across Pulumi Cloud
Releases
Major and minor versions only — no patches.
- tvOS 27.2 (24K122)
View downloadsView release notes
- visionOS 27.2 (24N120)
View downloadsView release notes
- watchOS 27.2 (24S118)
View downloadsView release notes
- ComfyUI 0.43.0: modelprefetch, syncrhonize all graph cleanups by @rattus128 in #17178
What's Changed model_prefetch: syncrhonize all graph cleanups by @rattus128 in #17178 Add rope scaling support to MOSS-image by @kijai in #17172 [Partner Nodes] Renew partner-node sign-in tokens in API nodes by @dante01y…
- electron v44.10.0
Release Notes for v44.10.0 Features Added filtering options to session.registerPreloadScript - matches, excludeMatches, includeGlobs, excludeGlobs, matchOriginAsFallback. #55182 (Also in 45 ) Fixes Fixed a crash on Linux…
- electron v45.1.0
Release Notes for v45.1.0 Features Added filtering options to session.registerPreloadScript - matches, excludeMatches, includeGlobs, excludeGlobs, matchOriginAsFallback. #55181 (Also in 44 ) Fixes Fixed a crash on Linux…
- v45.2.0
v45.2.0
- Release v0.66.0
What's Changed Update ROADMAP.md to no longer reference outdated 2025 roadmap by @DavidAPierce in #29723 Changelog for v0.65.0-preview.0 by @gemini-cli-robot in #29739 chore(release): bump version to 0.66.0-nightly.20261…
- Google Gen AI SDK 2.34.0: Add support for continuationtoken and requirescontinuation status (daac53e)
2.34.0 (2026-10-29) Features Add support for continuation_token and requires_continuation status ( daac53e ) Add support for Python 3.15. ( cb1408b ) Add video upscale task parameter ( 0456043 ) Drop support for Python 3…
- Goose 1.57.0: Allowlist, require HTTPS and validate redirects, block on policy failure #12619
Features Allowlist: require HTTPS and validate redirects, block on policy failure #12619 Allow callers to supply Goose session IDs #13098 Bug Fixes Linux window icons restored in desktop app #13120 OpenRouter: resolve va…
- LanceDB v0.41.0
This release uses Lance 14.0.2. Python embedding configuration migration This release changes SentenceTransformerEmbeddings.trust_remote_code to default to False and requires process-level approval before restoring remot…
- NestJS 12.3.0: platform-node
v12.3.0 (2026-10-27) Features platform-node #18063 feat(node): add a native node http platform adapter ( @kamilmysliwiec ) Bug fixes common #18289 fix(common): report the detected file type in file type errors ( @DenisCD…
- 2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlau
Notable Changes This release marks the transition of Node.js 26.x into Long Term Support (LTS) with the codename 'Lithium'. It will continue to receive updates through to the end of April 2029. Other than updating metada…
- ONNX Runtime WebGPU Plugin EP v0.5.0
ONNX Runtime WebGPU Plugin EP 0.5.0 expands attention, mixture-of-experts, and quantized operator support, improves GPU kernel performance, and strengthens runtime integration and correctness. Highlights Performance Enab…
- OpenAI Codex 0.165.0: GPT-6.1 Terra to the model catalogs. (#57337)
New Features Added a built-in Google Cloud Vertex AI provider, configured with model_provider = "gcp". ( #56265 ) Added GPT-6.1 Terra to the model catalogs. ( #57337 ) Added a repository filter to the session picker and…
- OpenAI Codex 0.166.0: GPT-6.1 Terra to the bundled, Vertex AI, and Amazon Bedrock model catalogs. (#57293)
New Features Added keyboard-driven transcript selection with word, line, and page motions, integrated search, and configurable shortcuts. ( #57221, #57222, #57223, #57224 ) Rendered Markdown consistently in async questio…
- OpenAI Node SDK 7.44.0: api, add delegation controls and prompt cache lifetimes and scheduled automations via…
7.44.0 (2026-10-25) Features api: add delegation controls and prompt cache lifetimes and scheduled automations via client.beta.agents.automations, including invocation endpoints and the automations agent-tool variant ( #…
- OpenAI Node SDK 7.45.0: api, add gpt-6.1-terra model identifier (#3054) (f8120e5)
7.45.0 (2026-10-26) Features api: add gpt-6.1-terra model identifier ( #3054 ) ( f8120e5 ) Bug Fixes deps-dev: bump @cloudflare/workers-types from 5.20261011.1 to 5.20261018.1 in /ecosystem-tests/cloudflare-worker ( #303…
- OpenAI Node SDK 7.46.0: api, add agent context compaction settings (#3075) (3e3918d)
7.46.0 (2026-10-31) Features api: add agent context compaction settings ( #3075 ) ( 3e3918d ) api: add agent session review and tool settings ( #3083 ) ( fb9c100 ) api: add experimental agent time awareness ( #3078 ) ( 2…
- OpenAI Python SDK 3.38.0: api, add delegation controls and prompt cache lifetimes (#4169) (43045fc)
3.38.0 (2026-10-25) Features api: add delegation controls and prompt cache lifetimes ( #4169 ) ( 43045fc ) api: expand Live Decision item and question types ( #4175 ) ( 5d72315 ) Bug Fixes agents: clarify result schema w…
- OpenAI Python SDK 3.39.0: api, add gpt-6.1-terra model identifier (#4180) (e8beb1a)
3.39.0 (2026-10-26) Features api: add gpt-6.1-terra model identifier ( #4180 ) ( e8beb1a )
- OpenAI Python SDK 3.40.0: api, add prompt cache breakpoint TTL options (#4188) (3596d18)
3.40.0 (2026-10-27) Features api: add prompt cache breakpoint TTL options ( #4188 ) ( 3596d18 ) Bug Fixes ci: use an explicit browser demo dependency ( #4185 ) ( a3f4302 ) Chores api: record completed generated-code sepa…
- OpenAI Python SDK 3.41.0: api, accept typed references in Realtime response inputs (#4189) (8ecb487)
3.41.0 (2026-10-28) Features api: accept typed references in Realtime response inputs ( #4189 ) ( 8ecb487 ) api: add response tool usage models ( #4201 ) ( 55fc500 ) api: filter agent sessions by metadata ( #4200 ) ( 77f…
- OpenAI Python SDK 3.42.0: api, add agent context compaction settings (#4209) (f552fcf)
3.42.0 (2026-10-31) Features api: add agent context compaction settings ( #4209 ) ( f552fcf ) api: add agent session review and tool settings ( #4217 ) ( a63c4cd ) api: add experimental agent time awareness ( #4211 ) ( 1…
- v1.70.0/v0.164.0
Images and binaries here: https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.164.0 End User Changelog Enhancements cmd/mdatagen: Add support for supported_platforms in component metadata,…
- service/v0.164.0
Module set beta, Version v0.164.0
- oxlint v1.90.0
Features cf34678 oxlint: Export Oxlintrc type ( #28132 ) (Sysix) 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 ( #28118 ) (camc314) d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule…
- oxfmt v0.75.0
Bug Fixes 5042019 formatter: Keep fill layout for array with comment after [ ( #28170 ) (leaysgur) 9d37ff6 formatter: Use position-based comment checks for concise arrays ( #28169 ) (leaysgur) 016c4a2 formatter: Keep a c…
- sdk/v3.273.0: Update module golang.org/x/net to v0.62.0 [SECURITY] (#25431)
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | golang.org/x/net | v0.60.0 → v0.62.0 | | | | golang.org/x/net | v0.61.0 → v0.62.0 | | | Warning Some dependencies could…
- Pulumi 3.273.0: [auto] Add up to the generated automation APIs for NodeJS, Python and Go #25055
3.273.0 (2026-10-28) Features [auto] Add up to the generated automation APIs for NodeJS, Python and Go #25055 [auto] Add logs commands to the generated automation APIs for NodeJS, Python and Go #25065 [pcl] Add a resourc…
- pkg/v3.273.0: Changelog and go.mod updates for v3.273.0 (#25440)
Co-authored-by: github-actions github-actions@github.com
- v2.14.0 2026-10-08
What's Changed The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy ) are also included in this release. Make sure…
- 8.12 RC1
This is the first Release Candidate of Redis 8.12 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Headlines: Redis 8.12 introduces new feature…
- Rollup 4.66.0: Support null sources in plugin-generated sourcemaps (#6600)
4.66.0 2026-10-28 Features Support null sources in plugin-generated sourcemaps ( #6600 ) Support plugin-generated "index" sourcemaps ( #6601 ) Bug Fixes Preserve rendering errors when the rendereError hook fails ( #6602…
- Rspack 2.3.0: See Announcing Rspack 2.3 for more details
What's Changed See Announcing Rspack 2.3 for more details. New Features feat: rename loader filter.code to codeFilter by @SyMind in #16184 feat: integrate allocative snapshots and profiling skill into Rspack by @intellil…
- Rust 1.99.0
Language Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows Extend unconditional_panic lint to function calls that panic when the chunks/windows size i…
- Rust 1.95.0
Language Stabilize if let guards on match arms irrefutable_let_patterns lint no longer lints on let chains Support importing path-segment keywords with renaming Stabilize inline assembly for PowerPC and PowerPC64 const-e…
- Rust 1.98.0
Language Allow shortening lifetime of &mut when unsize-coercing, even in an invariant position. For example, you can now coerce a Cell<&'long mut i32> to a Cell<&'short mut dyn Send>. Such shortenings were already previo…
- swc_core@v83.0.0
chore: Publish crates with swc_core v83.0.0
- @supabase/config v0.12.0
0.12.0 (2026-10-26) Bug Fixes cli: warn that deprecated config, env vars and import maps are removed in v3 ( #7154 ) ( 8a549df ) config: explain config parse errors and reject inf/nan ( CLI-2755 ) ( #7267 ) ( b1c2e5c ) c…
- @supabase/config v0.13.0
0.13.0 (2026-10-26) Features config: publish x-secret markers in the config JSON schema ( #7330 ) ( f6f7859 )
- @supabase/config v0.14.0
0.14.0 (2026-10-27) Features config: accept env() on number, boolean, enum and list fields in the config schema ( #7333 ) ( 3507dba )
- TRL 1.17.0: Mistral Large 4, fine-tune a 1T-parameter model on one node
Features Mistral Large 4: fine-tune a 1T-parameter model on one node TRL now supports mistralai/Mistral-Large-4-1T-A52B: 1T parameters, 52B active. The new LoRA example fine-tunes it with SFTTrainer on a single 8×B300 no…
- Temporal 1.33.0-164.2: patched temporal version
patched temporal version
- Temporal 1.33.0-164.3: patched temporal version
patched temporal version
- Temporal 1.33.0-164.4: patched temporal version
patched temporal version
- Temporal 1.33.0-165.1: patched temporal version
patched temporal version
- Release: v5.21.0
Release v5.21.0 New Model additions MiniCPM-OCR MiniCPM-OCR is a document-understanding model from OpenBMB's MiniCPM-V family. It keeps the MiniCPM-V 4.6 architecture, which pairs a SigLIP vision encoder and a window-att…
- v5.22.0: Mistral Large 4 (Le Chonk)
New Models Mistral Large 4 (Le Chonk) Mistral Large 4 is Mistral's largest and most capable model to date: a 1 trillion-parameter natively multimodal Mixture-of-Experts model with 49 billion active parameters per token (…
- Triton 3.9.0 Release Notes
Triton 3.9.0 Release Notes Table of Contents Dialect & Frontend Backend & Compiler AMD/HIP Backend NVIDIA Backend Gluon & Layout Improvements Kernels & Benchmarks Proton Profiling Testing & CI Build & Infrastructure Docu…
- 1.144.0
https://code.visualstudio.com/updates/v1_144
- entities v9.0.0
Full speed unlocked: This release features a faster approach to decoding entities based on cuckoo hashing, replacing the previous trie based approach. Instead of walking a trie character by character, we now do a few loo…
- b11890: deepseekv4.1: follow-up review fixes (#31137)
kv-cache: use ggml_backend_tensor_copy to refill the DSV4 K mirrors llama: move the Engram pad id to llama_hparams and the token map to llama_model The saver no longer needs the deepseek41 model class. deepseek41: drop t…
- openai 7.45.0
The official TypeScript library for the OpenAI API
- langchain 1.6.0
Typescript bindings for langchain
- @google/genai 2.32.0
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…
- opencode 2.2.0: Create, install and share Desktop plugins (experimental) (#55246, #59469, #59489)
Highlights Create, install and share Desktop plugins (experimental) ( #55246, #59469, #59489 ) Refreshed the desktop app experience ( #56898, #58865, #55838, #57962 ) Add experimental image and decision generation APIs t…
- process-daemon v0.4.0
opencode-pty 0.4.0 (protocol 7) from packages/process-daemon, published to npm as @opencode/pty@0.4.0.
- pnpm 12.16
This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing. Minor Changes Added a repeatabl…
- pnpm 12.17
pnpm 12.17.0 adds pnpm peers check --global, dependency-group selectors and wildcards in overrides, and runtime, package manager, Cargo, and Python updates in pnpm outdated and pnpm update. It also fixes files that other…
Research
The papers most useful to a developer this week.
- Vulnerabilities and Defenses in Audio-Visual Attacks: A Survey From Audio to Multimodal Models
With the rapid development of multimodal large language models (MLLMs) and the cost of large amounts of data and resources, researchers are more inclined to use public datasets and fine-tune open-source MLLMs to achieve excellent performance in audiovisual related tasks 1 . While…
- The Impact of Explanation Characteristics on the Effects of Recommender Systems Explanations
There seems to be a consensus that adding explanations to AI systems, such as recommender systems, can have positive effects, such as increasing a user’s trust, the transparency of the system, or the efficiency of a decision-making process. It is to this date unclear, though, how…
- SIMTSim: Exploiting Hardware Platform Parallelism for GPGPU Instruction Set Simulation
The rapid proliferation of specialized GPGPU SIMT (Single Instruction, multiple threads) architectures for AI and data parallel workloads demands fast, functionally accurate simulation to drive ISA exploration and software stack development. However, traditional instruction set s…
- FCoral: A Framework for Fine-grained Concurrency Evaluation Across Programming Language Runtimes
Modern programming languages increasingly support lightweight concurrency abstractions (e.g., coroutines), which are managed by language-level runtimes to improve scalability and performance in highly concurrent applications. Compared with coarse-grained thread-level concurrency,…
- Deterministic Fully-Static Whole-Binary Translation without Heuristics
We present Elevator , the first binary translator capable of statically translating entire x86-64 binary executables to AArch64 without using debug information, source code, or any assumptions about code patterns or layouts within the original binary. Unlike existing binary trans…
End of the week.← The week before · The week after →