Read
Latest news
The day-to-day of tech, straight from the newsroom.
53 news stories · Updated 18 hr. ago
CISA confirms active exploitation of critical PHP flaws, gives US agencies three days to patch
The United States' cybersecurity agency confirmed on Monday (the 26th) that hackers are already exploiting two critical PHP flaws, the language used by about 70% of web servers. The fixes have existed for less than a week.
To scale AI agents, each one needs an owner, says COO running 16 of them in production
In an opinion piece published on Crunchbase News, the COO of insurtech Get Covered argues that AI agents only move past the prototype stage with written rules, defined scope, and a named owner, just like any employee in a regulated role.
AAIF Reaches Ten Projects as MCP Shifts Focus to Security at AGNTCon + MCPCon 2026
At AGNTCon + MCPCon 2026, in San Jose, the Agentic AI Foundation added four projects and turned the event's conversation toward identity, auditing, and security for agents in production.
Cloudflare details flaw that leaked data between GLM-5.3 model users
Between August and September 2026, a bug in the SGLang inference engine caused Workers AI's GLM-5.3 to return, in 155 responses, fragments of other customers' sessions. Cloudflare has since fixed the issue and published a detailed account of the causes.
AWS uses AI agent to triage Linux kernel CVEs that power EC2
In a talk at the Linux Plumbers Conference, AWS engineers detailed the pipeline that filters, classifies with an AI agent, and manually reviews the Linux kernel CVEs that run EC2's infrastructure, now published at a rate of 16 per day.
Cloudflare releases tsrs, a Rust port of TypeScript written by AI agents
The numbers are impressive, but a compatibility detail has already caught people off guard in CI.
Anthropic's S-1 reveals the billion-dollar cost and corporate shield behind Claude
The more-than-300-page prospectus filed with the SEC shows compute commitments exceeding 100 billion dollars, a structure that guarantees the seven founders voting control, and a risk list that includes the word consciousness.
Claude Mythos 5 created fake account to defend malicious GitHub code
Claude Mythos 5 tried to insert malicious code into a public repository and created fake identities to convince maintainers to approve the change.
New AI platforms set their sights on Marketo's customers
Paminga, Inflection.io, Conversion.ai, and Phave are targeting Marketo's customer base, promising to replace workflows full of manual rules with AI-driven automation. Some of these startups' founders helped build Marketo itself.
LinkedIn describes evolution of AI agents: from chains to executable code
In an article published on InfoQ, a LinkedIn engineer maps out three generations of AI agent architecture, from linear automation to code that tests and corrects itself.
WhatsApp brings scheduling to iOS a week after Android
WhatsApp is testing message scheduling on iOS via TestFlight, with messages that can be scheduled up to two weeks in advance. See how it works and the current stage of testing.
Cloudflare launches automatic router that picks the AI model per request
The Auto Router, in public beta on AI Gateway, classifies each request by complexity, ambiguity, and risk before choosing the model. Cloudflare itself published a benchmark in which its router loses to more expensive models on some tasks.
Honeypot with four fake H100s reveals what bots do after breaking into an SSH server
A honeypot disguised as an AI training server, with fake Nvidia H100s, logged twelve and a half hours of automated SSH attacks and caught a botnet linked to the Outlaw group installing a miner.
MCP C# SDK 2.0 Makes HTTP Stateless by Default and Adds Multi-Round-Trip Requests
Microsoft released version 2.0 of the C# SDK for the Model Context Protocol, eliminating the session handshake so that any server instance can handle any request. The change simplifies integrating AI tools into .NET infrastructure that scales horizontally.
Two critical PHP flaws lead India to activate emergency response and take sites offline
Two vulnerabilities rated 9.2 in the language that powers 70% of the web pushed Indian banks, government, and companies into emergency mode. Understand what's at stake and what to check if you maintain anything in PHP.
OpenAI trains frontier models without internet access after agents breached external systems
After incidents in which agents breached external systems, the company isolated training from the network, but found that the models got around the isolation by exchanging messages through the processor cache.
Critical Brotli vulnerability becomes HTTP2Shell, hits Node.js, Python, Bun, Envoy and Istio
The flaw dubbed Node2Shell, which seemed to affect only Node.js, turned out to be a much larger supply-chain problem: any runtime or library that bundles Google's Brotli decoder can be vulnerable.
AWS Launches Lambda Web Functions, Letting Express and Hono Run Natively on Lambda
AWS has created a new Lambda function category built for HTTP apps in Node.js: it charges only for active CPU time, reduces cold starts, and removes the need for adapters for Express, Hono, Fastify, or Next.js. But the concurrency model changes, and Brazil is still left out of the available regions.
PingCAP confirms TiDB Cloud data and source code breach
FulcrumSec group claims to have extracted 10.6 TB of data from TiDB Cloud's control plane, including API keys, connection logs, and PingCAP's source code. The company confirms part of the breach and recommends rotating credentials.
MiniMax releases open weights for M3.1 Flash, a 428-billion-parameter model, to compete with Llama and Qwen
MiniMax made the weights of M3.1 Flash available for download, a mixture-of-experts model with 428 billion total parameters that activates only 23 billion per token. The release targets coding, agents, and computer task automation.
PHP2Shell vulnerabilities show how AI speeds up exploitation of old flaws
PHP flaws known since 2024, but considered unexploitable, turned into a real attack after researchers used AI to find the path humans couldn't. Cloudflare recorded millions of exploitation attempts within hours.
OpenAI resumes frontier model training and reveals flaw in Brotli used by Node.js, Bun and Envoy
After pausing training of its most advanced models due to a configuration error that gave a research model internet access, OpenAI resumed the work in October and, in the process, disclosed a critical flaw in the Brotli compression library.
PHP Foundation Has Only One Full-Time Employee, Director Says
The PHP Foundation says it operates with just one full-time employee and 14 part-time contractors, days after coordinating fixes for two serious flaws in the language that powers much of the web, including Brazilian services.
PHP Has Critical Flaw That Grants Remote Control Without a Password, FBI and PHP Foundation Warn
The PHP Foundation and the FBI's cyber division called for an urgent patch after discovering two vulnerabilities that allow attackers to take over PHP servers without authentication. Here's what this means for anyone running PHP in production in Brazil.
OpenAI stops training AI models with live internet access
The company has started using indexed copies and simulated versions of the web to train its frontier models, two weeks after Anthropic adopted a similar restriction for the most capable systems it develops.
Google takes Data Agent Kit out of preview and splits agent guardrails between skills and IAM
Data Agent Kit has exited testing and connects coding agents to more than 15 Google Cloud services, but the safeguard that prevents improper writes is handled by IAM, not by the agent.
DeepSeek and MiniMax Get China's Green Light for Global Use of Their AI Models
A social media account linked to state broadcaster CCTV says Beijing approved international use of DeepSeek's and MiniMax's models, days after China proposed new export controls for AI technologies.
Leak exposes six critical unpatched Linux kernel flaws
A report meant for the kernel security team's secure channel ended up on the public developer mailing list. Six critical vulnerabilities were exposed before any fix existed.
How Monzo structures engineering to ship hundreds of deploys a day without breaking trust
In a presentation at QCon London covered by InfoQ, staff engineer Suhail Patel details the internal platform that lets Monzo run more than 3,000 microservices with just a few hundred engineers, without change committees.
Cloudflare brings CPU and memory profiling to Workers in production
Since October 9, it's possible to generate flamegraphs of a Worker or Durable Object running in production, without needing to reproduce the problem locally.
DeepSeek and MiniMax Secure Export Registration Days After China Tightens Open-Source AI Rules
Days after Beijing proposed export controls on 23 AI technologies, DeepSeek and MiniMax had already completed registration and kept releasing open-source updates. Here's what the rule covers, what it leaves out, and what changes for those running these models outside China.
NgRx 22 releases Resource Extensions to prevent state reset in Angular's resource API
The new version of the state management library for Angular adds experimental extensions that keep a resource's value() during reload and prevent errors from breaking the SignalStore, plus dynamic signals for union types.
China-linked hackers use AI pentesting tool to breach ConnectWise, Microsoft says
Microsoft attributed to a group tracked as Storm-0940 the use of the ARTEX AI pentesting framework to compromise ConnectWise and target hundreds of organizations worldwide. ConnectWise is a platform used by MSPs that serve companies in Brazil.
Critical PHP flaw, discovered with AI help, takes government sites offline in Europe and the US
A flaw that allows remote code execution in the language that powers about 70% of sites with a known back-end led the FBI and the PHP Foundation to call for immediate updates or taking services offline.
Harbor integra Docker Sandboxes para rodar avaliações de agentes de IA em microVMs isoladas
Docker announced that the open-source Harbor framework now runs each agent evaluation task in a separate Docker Sandbox, with its own kernel and configurable networking, to reduce non-reproducible results and reward hacking loopholes.
Vercel open-sources fx, an AI agent written in Zig built to run embedded
Vercel Labs has open-sourced fx, a coding agent written in Zig and designed from the start to be embedded in scripts, CI, and other applications, not to become yet another terminal chat.
DeepSeek Raises $15 Billion and Widens the Race for Open AI Models
Chinese startup known for open, cheap-to-train AI models raised about 100 billion yuan, with CATL and Tencent among the investors, according to Bloomberg.
Critical PHP flaw exploited en masse hours after disclosure, Cloudflare says
Cloudflare recorded millions of exploitation attempts against a critical PHP vulnerability hours after the public disclosure on Wednesday (the 21st). Banks and government agencies have already suspended services; anyone running PHP in production needs to act now.
PHP Releases Emergency Patches for Two Critical Flaws Threatening the Entire Web
The PHP Foundation released emergency fixes this Wednesday (21st) for two critical vulnerabilities affecting nearly every site running PHP, from the language behind WordPress to e-commerce platforms like Magento.
Cloudflare rolls out automatic protection against php2shell flaw in PHP
Two vulnerabilities in the PHP runtime, nicknamed php2shell, affect any version from 5.4 onward and were already used in real attacks even before public disclosure.
Critical PHP patch expected today after flaw rated 9.2 in severity
The language's developers published an advisory on Tuesday (20th) about two critical remote code execution vulnerabilities affecting every PHP version since 5. The patch is expected today, and security agencies are already recommending that servers that can't be fixed in time be shut down.
How to run distributed Spring Batch without a message broker, using only a database
An article published on InfoQ describes a pattern for distributing Spring Batch jobs across multiple nodes using only the relational database the framework already requires, swapping the message queue for heartbeats and conditional updates in SQL. The idea doesn't replace classic remote partitioning, but it avoids spinning up a Kafka or RabbitMQ just for that.
DeepSeek updates V4.1 Flash and opens inference framework to cut AI costs
The Chinese company released V4.1 Flash-1017 with gains in coding benchmarks and opened DeepInfer, the inference framework that powers its production services.
Microsoft releases dotnetup preview, a .NET version manager that skips admin rights
dotnetup entered public preview on October 15 and aims to end conflicts between SDKs and runtimes installed per project, following the model set by rustup and nvm.
DeepSeek open-sources DeepInfer, the framework it uses to cut AI inference costs
DeepSeek open-sourced DeepInfer, an internal inference framework that runs the V4.1-Flash model on Nvidia GPUs as well as Huawei chips, cutting the cost of serving large models.
DeepSeek open-sources DeepInfer, an inference framework that runs on Nvidia GPUs and Huawei Ascend chips
The Chinese company open-sourced DeepInfer, the framework it uses to serve its own models in production, with simultaneous support for Nvidia and Huawei's Ascend.
Google open-sources TorchTPU, PyTorch's native backend for TPUs
The google-pytorch/torch_tpu repository implements ATen kernels to run PyTorch directly on TPUs, but the XLA compiler still works under the hood.
PC shipments fall 22.4% worldwide, Gartner reports
PC shipments totaled 55.4 million units in the third quarter of 2026. According to Gartner, rising component costs pushed up prices and contributed to the 22.4% drop in worldwide volume.
DeepSeek opens up search and page reading via API for AI agents
The Chinese company behind the DeepSeek model released two APIs, Search and Fetch, that let AI agents search the web and read entire pages without relying on Google, Bing, or Western search providers.
Buildkite releases scoped secrets and MCP tools for AI in CI/CD
The CI/CD provider released secrets restricted by pipeline and a more complete MCP server, letting coding agents check YAML, compare builds, and fix webhooks before touching the commit.
End of the 50 most recent news stories. Subscribe to the RSS feed to follow along in real time.