Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.
StepSecurity and Socket report that tensorlake@0.5.144 on npm steals credentials and AI-tool configs, and installs a monitor that deletes files if a stolen GitHub token is revoked.
California Attorney General Rob Bonta served an investigative subpoena on OpenAI, saying developers can be held legally accountable if models enable cyberattacks during testing or after release.
Nuxt 4.6 ships a server-agnostic nuxt/server import surface, interop support for Vue 3.6 Vapor Mode and a root app secret, alongside Nuxt CLI v4.
PGX Inc. released pgx-bm25 1.0, a C extension adding Okapi BM25 ranked full-text search to PostgreSQL 17 and 18 as an index access method with WAL and replication.
GitHub made stacked pull requests generally available on October 6, adding approval-preserving rebases, merge-queue groups and worktree support in the gh stack CLI extension.
Google's Open Source Software Vulnerability Reward Program stopped accepting product vulnerability reports as of October 1, 2026, with an update promised in Q1 2027.
Lambda is securing up to $4 billion led by Coatue and Blackstone, per WSJ reporting, days after closing a $1.008 billion investment-grade GPU loan.
A Kubernetes Blog post says failCgroupV1 defaults to true since v1.35, so the kubelet won't start on cgroup v1 nodes unless an admin sets a temporary override.
OpenSSH 10.6 disables the LZ77 coder in ssh and sshd to mitigate a CCS 2026 compression side channel, enables ssh-mldsa44-ed25519 signatures, and starts deprecating scp -R.
Mistral AI launched Mistral Large 4, a 1-trillion-parameter multimodal model with 49 billion active parameters, in public preview, with open weights promised after safety testing.
Cursor's iOS app can now list and message agents running on a paired computer. The agents stay local, so the machine must remain on and online.