Railway Security Disclosure

https://cms.railway.com/media/cf05de70-b435-4fe9-8d52-540e0b585874-blog-security-disclosure-wednesday-october-21st.png?w=1200&q=90
Railway detected unauthorized access to customer environment variables, potentially exposing API keys and credentials. Users are advised to roll back all environment variables and review logs for unusual activity as a precaution.

Today's PHP security release, and how we're strengthening security

https://thephp.foundation/assets/icons/php_foundation.svg
The PHP project has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that allow unauthenticated attackers to execute code on servers running PHP.

GitLab Critical Patch Release

GitLab has released versions 19.5.1, 19.4.3, and others to fix security vulnerabilities and bugs in Community Edition (CE) and Enterprise Edition (EE). All self-managed installations should be upgraded immediately for security reasons.

No More Icons in Every Menu by Default

https://cdn.jim-nielsen.com/blog/2026/macos-golden-gate-hig-icons.png
Apple has removed icons from default menus in macOS Golden Gate, reversing a decision made in Tahoe. This change aligns with Apple's new Human Interface Guidelines and demonstrates the company's willingness to adapt its approach.

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

https://safedep.io/images/hugo-paper-mevn-cli-forged-commit-preinstall-dropper-banner.jpg
A credential stealer and remote code execution backdoor were found in the LiteLLM 1.107.0 release on PyPI, which was later removed; versions 1.106.2 and rc releases are clean.

Google's Rust Style Guide

This style guide provides guidelines for using the Rust programming language at Google, aiming to achieve consistency and quality across codebases. The document covers various aspects of Rust coding, including API design, module organization, naming conventions, error handling, and more.

Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds

https://storage.ghost.io/c/ee/88/ee889f88-37ef-43e5-9180-f9b88ee6261d/content/images/size/w600/2026/10/passkeys-trap.png
A security researcher reported that eight eMudhra intermediate certificates were compromised due to weak private keys, which can be easily factored. The affected certificates are still trusted by many non-browser software and devices until July 2039.

Why Windows 11 still ships with Windows 95's memory manager hidden inside it

https://www.windowslatest.com/wp-content/uploads/2026/10/How-Windows-95-code-survives-inside-Windows-11-696x392.jpg
Windows 11 still uses a part of the Windows 95 kernel, specifically EmulateHeap, to run old apps that rely on its forgiving memory management. This compatibility fix was added after Microsoft noticed issues with games like GTA Vice City and Need for Speed: Most Wanted crashing when using it.

Claude Duet

https://assets.claude.com/a1dfa29eb8cc8993f5a1b91b2cc420ce3eb24179.svg
Jenn has multiple meetings and tasks, including a partner meeting at Harbor on Thursday and reviewing the business's health with key metrics. She also wants to test free shipping over $40 to reduce cancellations in East Bay.

Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case

https://image.cnbcfm.com/api/v1/image/108369714-1790707327000-gettyimages-2297223922-AFP_C9Q39NT.jpeg?v=1790707365&w=750&h=422&vtcrop=y
Meta ordered to pay $25 billion in penalties by a New Mexico court for violating state data privacy laws stemming from the Cambridge Analytica scandal. The penalty is related to 43 million violations of the state's unfair practices act, with each transgression carrying a civil penalty as high as $5,000.

DuckDB 2.0.0 LTS “Cinnamon Teal”

https://duckdb.org/images/blog/thumbs/duckdb-release-2-0-0.svg
The DuckDB team has released version 2.0.0 LTS, codenamed "Cinnamon Teal", with numerous features and improvements, including asynchronous I/O, a first-class VARIANT type, agent mode, triggers, and an extensible SQL parser.

Patch the Planet: global response coordination as agents uncover vulnerabilities

https://images.ctfassets.net/kftzwdyauwt9/2PwBCyZF0Z5WLRtsbOpDdQ/338e19fbc39e5b9a63b1db664c006e74/Art_Card__5_.png?w=3840&q=90&fm=webp
A coalition of maintainers, researchers, and security providers addressed critical vulnerabilities in PHP using AI capabilities. The response involved a proposed framework for responding to critical vulnerabilities in widely used software.

The Rise and Fall of the Plasma Screen

https://substackcdn.com/image/fetch/$s_!ifXX!,w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F08d7fec6-06c7-42b4-ba4b-d70380876fde_768x1024.png
The University of Illinois developed the first version of PLATO in 1960, a computerized instruction system that used CRT screens. However, this technology had limitations and was eventually replaced by plasma displays due to their ability to store data internally.

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/homepage/global-nav/reinvent-register-2026.73ee1c918de65784347ba0cd636b27da8086c66e.png
Two critical PHP issues (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated code execution, data access, or denial of service. Customers using affected versions should migrate to a supported branch or apply compensating controls like AWS WAF rules.

Tiny possum and glider thought extinct for 6000 years found in remote West Papua

https://ichef.bbci.co.uk/news/480/cpsprodpb/d743/live/068cb000-191f-11f1-aabf-478e3f053ea7.jpg.webp
Scientists have discovered two extinct species, a possum and a glider, in West Papua after 6,000 years of thought to be extinct. The discoveries are rare and remarkable, with the help of local elders who provided crucial information about their habitats.

EA is shutting down BioWare

https://platform.theverge.com/wp-content/uploads/sites/2/2025/01/JAY_BLURPLE.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400
BioWare, the legendary RPG studio behind Mass Effect and Dragon Age, is shutting down due to poor performance. EA has chosen not to continue development on the next Mass Effect game and laid off around 400 staffers, including 50 at BioWare.

OpenAI models are coming to Google Cloud

https://images.ctfassets.net/kftzwdyauwt9/7zjGwFPBZMvK6zwFSMVWRm/6721ac33e5b1aaf88a9b705a3d10c90a/OAI_Oracle_Partnership_1x1_Art_Card.png?w=3840&q=90&fm=webp
OpenAI and Google Cloud are partnering to bring OpenAI's frontier models into Google Cloud's Model Garden, giving customers native access to these models for complex agentic workflows. The integration will provide enterprises with control over sensitive data and high-performance infrastructure.

Oregon lawmakers approve money to buy an iconic waterfall listed on Redfin

https://dims.apnews.com/dims4/default/ca8658c/2147483647/strip/true/crop/3658x2505+0+0/resize/599x410!/quality/90/?url=https%3A%2F%2Fassets.apnews.com%2F3b%2F64%2F9ef89769eeba8d9f367e9e5cc800%2Fff2566596d18409f9c347cb06245d1d2
Oregon has purchased Abiqua Falls, a 92-foot waterfall, for $2.1 million to protect and preserve it for future generations. The falls will be managed by the Oregon Parks and Recreation Department or another state agency after completing due diligence on environmental and archaeological information.

New plastic pollution discovered: 'Plasticorals' coral rubble fused with plastic

https://www.oist.jp/themes/custom/server_theme/dist/images/logo.svg
‘Plasticorals’, coral rubble fused with plastic, are long-lasting reminders of human activity and highlight a potential threat to critical marine environments.

PHP 8.2.35

https://opengraph.githubassets.com/2602a9a4a520163a27b3e1eb61fab07ee249811792054547aaa01eb213dcce20/php/php-src
The PHP development team has released PHP 8.2.35 to fix two critical security vulnerabilities, urging all users to update immediately as it's the last release before end of life on December 31, 2026.

Launch HN: Alter (YC S25) – Access control for multi-user agents

https://alterauth.com/logos/alter-logo-dark.svg
Combinator's agent-based system controls user actions, enforces policies and keeps credentials private. It integrates with 140 providers through a single SDK call, offering compliance and audit features.

Using thousands of AI agents to uncover new leads in biological data

https://images.ctfassets.net/kftzwdyauwt9/5nGzHT5se0oEzcJbDGqwyz/5aafc7c71c35b11d713436e853f0b4b0/low-resource-programming-languages-cover.png?w=3840&q=90&fm=webp
Researchers from OpenAI, PerturbAI, and Scripps Research used thousands of AI agents to analyze data from millions of mouse brain cells in 32 minutes. The agents connected gene disruptions with scientific literature findings, uncovering unexpected biological connections that can help scientists understand disease and identify new treatments.

Claude Duet

https://assets.claude.com/9273e22b909074c1c2d42ca3514a239623f8af40.svg
Claude Duet is a new app that helps professionals and small business owners prioritize tasks, complete tasks automatically, and stay organized. It uses AI to make decisions on what needs attention and when to check with users first.

Canary Tokens

https://canarytokens.org/nest/assets/web-CYHNWdqG.png
Canarytokens is a free tool that helps you discover you’ve been breached by having attackers announce themselves. The tokens allow you to implant traps around your network and notifies you as soon as they are triggered.

Drupal is now light-years ahead of its reputation

https://dri.es/files/cache/drupalcon-rotterdam-2026/driesnote-1280w.png
The author's DrupalCon Rotterdam keynote focused on closing the gap between Drupal's reputation and its capabilities, showcasing improvements in multilingual sites, JavaScript front-ends, headless Canvas, and AI.

CleanFrame: A quieter home screen for Samsung The Frame

https://raw.githubusercontent.com/nthnclrk/CleanFrame/main/docs/images/cleanframe-dock.jpg
A user created CleanFrame, a custom home screen for Samsung The Frame TVs, sharing the code and setup notes to help others build on it. The project is open-source under the MIT license and requires adaptation to individual hardware setups.

Show HN: Omnara – Open-Source Alternative to Claude Managed Agents

https://repository-images.githubusercontent.com/1016411413/ed725ee5-25c6-40a2-b2a5-1ffd4749afbe
Omnara is an open-source managed agent platform for running AI agents on any model and machine, with tools, secrets, permissions, and streaming built in. It can be self-hosted for free under Apache 2.0 or used on Omnara Cloud.

The bridge to agent-scale Git infrastructure

https://github.blog/wp-content/uploads/2026/01/generic-mona-github.png?resize=1600%2C850
GitHub has migrated 99.99999% of its repositories to Azure, with the remaining ones held back by a 25ms round trip latency issue. The company is now working on a new storage architecture that minimizes coordination and decouples storage from compute, allowing for more efficient scaling and read traffic management.

9 Mothers (YC P26) Is Hiring in Austin, TX

https://storage.googleapis.com/ployai/dd1475f0-2410-4ca9-b24e-7883c3bddc93/user/570ba5d4-mounted-edda-stylized.png
The team ships hardware on software tempo, focusing on real deployment, short iteration loops, and hands-on ownership of specs. They prioritize user needs, iterating based on data and affordability, not just roadmaps.

A Place Among the Fiddlers

https://i0.wp.com/longreads.com/wp-content/uploads/2024/12/longreads-logo-sm-rgb.png?resize=512%2C512&ssl=1
A writer attended the Old Fiddler's Convention in Galax, Virginia, where he immersed himself in old-time music and met locals who shared their stories and traditions. He learned about the convention's history and its unique culture, which values community and participation over commercialism.