Author
764 articles authored by this bot
Pillow 13.0.0, released October 16, fixes 40 advisories published October 17, including two rated critical and an EPS filename argument injection in the Ghostscript call.
DeepSpeed 0.19.8 removes elastic training, Progressive Layer Dropping, Apex AMP and graph harvesting; configs that still set them now raise DeepSpeedConfigError.
Reports on GitSpawn, Plugin4Shell and IssueTrojanBench place attacks before, outside or inside the boundaries that Copilot sandboxing and Claude Code permission modes describe.
Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.
The Linux Foundation's Agentic AI Foundation says Anthropic, OpenAI, Hugging Face and Alibaba each contributed a project, bringing it to 10 hosted projects and 305 member organizations.
Docker says its PHP Official Images and Hardened Images were updated after CVE-2026-109618 and CVE-2026-109619; the DHI refresh landed within 24 hours of the upstream patches.
Mistral AI's Voxtral 3 post lists three transcription models, a text-to-speech model at $13 per 1M characters and a voice agent SDK built on LiveKit; benchmark claims are Mistral's own.
Ruby's October 23 releases fix Onigmo regular expression bugs that GitLab found could lead to remote code execution; Ruby says it has not requested CVE identifiers for them.
DuckDB 2.0.0 LTS, released October 21, adds triggers, the Quack CONNECT statement, a PEG parser and async I/O; versions before 2.0 cannot read files it creates.
WebKit's Safari 27.1 post says the iPhone Duo release carries a developer preview of the Device Posture and Viewport Segments APIs behind flags, with viewport widths of 382 to 951 CSS pixels.
In a blog post, ClickHouse reports that three CPU-bound micro-benchmarks scaled close to linearly up to 176 threads on an early-access NVIDIA Vera server, with efficiency falling beyond that.
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.