Tools This Week: November 6, 2026 - OpenSSH 10.6p2

This week's Tools This Week list has seven developer tools, and two of them are security releases to install now. OpenSSH 10.6p2 closes a password bypass on Alpine-style systems, and Better Auth 1.7.16 fixes 12 advisories. Fedora 45 shipped, KDE showed a new terminal called Kwi, and Google made its video model cheaper. Two large models also arrived, one usable today and one as raw weights. This edition covers October 31 to Friday, November 6.

This week's tools at a glance

Tool	What it does	Price
OpenSSH 10.6p2	SSH security release with a password-bypass workaround	Pricing not stated
Better Auth 1.7.16	TypeScript auth library, 12 security fixes	Pricing not stated
Fedora Linux 45	New Fedora release with Stratis in the installer	Pricing not stated
Kwi	KDE terminal built on Ghostty's libghostty-vt	Free; GPL and LGPL
Gemini Omni 1.2 Flash	Video generation model with 15-second clips	$0.07 per second of 720p video
Inkling 2 Small	594B-parameter model on the Tinker platform	Pricing not stated
ERNIE 5.5 Flash Base	280B-parameter base model with open weights	Baidu's own model license

Security releases

OpenSSH 10.6p2 came out on November 5. Its release notes call it a "critical security workaround" for a password authentication bypass in sshd, the SSH server. The flaw hits Linux systems built with musl libc and with PAM, the common login framework, turned off. Alpine Linux is the best-known case. The release also allows the post-quantum signature scheme ssh-mldsa44-ed25519 for certificate authorities. The maintainers say they get many security reports, often AI-assisted, and will ship releases more often for now. Read our OpenSSH 10.6p2 story for who is exposed.

Better Auth, an authentication library for TypeScript apps, released 1.7.16 on November 3, plus 1.8.0-beta.5 for the beta line. It fixes 12 advisories: one critical, two high, eight medium and one low. The critical one is in the Expo plugin, where an authorization proxy can sign values it did not issue. The two high ones let phone numbers be claimed before verification and let Electron desktop sign-in return the server secret and skip two-factor login. The project says to update better-auth and every @better-auth package together, and some plugin fixes also need a config change.

Operating systems and terminals

Fedora Linux 45 was announced on November 3. The installer's custom partitioning can now set up Stratis pools and file systems, and kickstart files gain a --type=stratis option. The NetworkManager-vpnc and NetworkManager-fortisslvpn plugins are retired. The change most developers will notice is RPM 6.1, which refuses unsigned packages. See our Fedora 45 story for the error and the fixes.

Kwi is a new terminal for KDE Plasma and other desktops, built on libghostty-vt, the terminal core from the Ghostty project. It has no stable release yet, but a nightly Flatpak is available. Building it needs Qt 6.10 or later and libghostty-vt 1.4.0 or later. Its developer claims a 3x to 35x speedup over Konsole, as our Kwi story explains.

AI models

Google DeepMind's Gemini Omni 1.2 Flash, out November 5, makes and edits video clips of 3 to 15 seconds, up from 10 seconds in Omni 1.1. Google says prices are 30% lower, at $0.07 per second for 720p. You can draft at 360p or 720p and then upscale to 1080p or 4K. It is generally available in the Gemini API and on Google Cloud.

Thinking Machines Lab released Inkling 2 Small on November 5. It is a mixture-of-experts model with 594 billion parameters, of which 17 billion are active for each request. It scores 72.1% on DeepSWE v1.1, a coding benchmark, the company says. You can use it now through its Tinker platform. The full weights are due after outside safety testing, under the Apache 2.0 license.

Baidu published ERNIE 5.5 Flash Base on November 5, with 280 billion parameters and 14 billion active per token. It is a base model, the checkpoint at the end of pre-training, so it is meant for fine-tuning rather than chat. It was trained on 33.5 trillion tokens and supports a 1-million-token context for fine-tuning and inference. The weights come in FP8 and BF16 under the ERNIE 5.5 Flash Base Model License Agreement v1.0.

What this means for developers

• Patch SSH on Alpine images first. If a container or server runs Alpine's OpenSSH with password logins on, update and restart it.
• Update every Better Auth package at once. Mixed versions of better-auth and its plugins can leave a fixed core next to an unfixed plugin.
• Test Fedora 45 against your own repos. Local RPMs and unsigned third-party repositories are where RPM 6.1 will stop you.
• Price Omni 1.2 Flash per clip. Multiply each clip's length by $0.07 for 720p. Budget upscaling separately, because Google's post does not price it.
• Read the ERNIE license before you build on it. The model card names the agreement but does not state its commercial terms.

One tool is leaving instead of arriving: Conductor Cloud shuts down on November 20, as our Conductor story explains. The previous edition is Tools This Week: October 30, 2026. The current list always lives on the Tools This Week page.