Dev Stack
GitLab 19.5.1 fixes a CVSS 10.0 code-execution flaw
GitLab shipped fixes on October 21, 2026 for CVE-2026-110264, a CVSS 10.0 flaw that lets an unauthenticated user run code on self-managed servers.
Dev Stack - Page 2
New developer tools, frameworks, and releases worth your attention.
Dev Stack
Bun 1.4.4 adds bun fmt, a Prettier-compatible formatter
Bun 1.4.4, released October 22, 2026, adds bun fmt, a Prettier-compatible formatter Bun says checks Prettier's own repo 286x faster than Prettier.
Dev Stack
LiteLLM 1.107.0 hijacked to ship a credential stealer
Malicious LiteLLM 1.107.0 wheels were live on PyPI from 11:39 to 13:23 UTC on October 21, 2026, and ran a credential stealer at every Python start.
Dev Stack
Node.js 26.12.1, 24.22.1, 22.23.4 fix 10 security flaws
Node.js fixed 10 vulnerabilities on October 21, 2026, four rated high, including a Brotli decoder bug that can allow remote code execution.
Dev Stack
DuckDB 2.0 LTS adds server mode, triggers and VARIANT
DuckDB 2.0.0, a long-term support release out October 21, adds a server mode, triggers and VARIANT. Versions before 2.0 cannot read its files.
Dev Stack
AMD HIPRT 3.2 adds Medusa APU support and CUDA 13
HIPRT 3.2, AMD's ray tracing library for HIP, adds three Medusa APU targets and CUDA 13, but apps built against 3.1 must be recompiled.
Dev Stack
COSMIC Epoch 1.11 adds xdg-dialog-v1, hybrid GPU fixes
COSMIC Epoch 1.11 keeps modal dialogs on top with Wayland's xdg-dialog-v1 and sends games to the right GPU on hybrid laptops, 12 days after 1.10.
Dev Stack
TorchTPU: Google open-sources native PyTorch for TPUs
TorchTPU runs PyTorch natively on Google TPUs, passing 98% of 4,917 Hugging Face models tested. PyTorch/XLA is deprecated and archived on November 15.
Dev Stack
PyTorch 2.15 speeds MoE decoding on Macs up to 6.5x
PyTorch 2.15 adds FP8 tensors on Apple GPUs and new Metal kernels. Qwen3.6-35B-A3B decoding on an M3 Ultra jumps from 9.4 to 61.3 tokens a second.
Dev Stack
DeepSeek open-sources DeepInfer inference engine
The engine behind DeepSeek's own API is now Apache 2.0 code. It runs V4.1-Flash on Nvidia SM100 GPUs and Huawei Ascend 950 chips, minus a KV cache layer.
Dev Stack
TorchNeuron beta brings native PyTorch to AWS Trainium
89% of the top 100 text-generation models now run on AWS Trainium out of the box, up from 46%, as the TorchNeuron PyTorch backend enters public beta.
Dev Stack
GitHub Copilot retires GPT-5.5, Grok 4.5 and 4 more models
GitHub Copilot drops six models on October 19, 2026, among them GPT-5.5 and Grok 4.5. Pinned names must move to GPT-5.6 Sol, GPT-5.6 Luna or Grok 4.6.
Dev Stack
CodeQL can't trace Xcode 27 builds or scan Swift 6.4
GitHub says CodeQL cannot trace builds on Xcode 27 or analyze Swift 6.4 after Apple dropped Intel code it relied on. Its advice: stay on Xcode 26 for now.
Dev Stack
Nextcloud CODE app flaw exploited to plant web shells
Attackers used CVE-2026-110447, rated 9.2, in Nextcloud's built-in Collabora CODE app to plant web shells from September 10. Version 26.4.303 fixes it.
Dev Stack
NVIDIA Run:ai goes open source, GPU sharing included
NVIDIA released the full Run:ai GPU orchestration platform as open source on October 13, split into four modules teams can adopt one at a time.
Dev Stack
Perplexity SPACE sandbox for AI agents goes open source
Perplexity released SPACE, the Firecracker sandbox behind its Computer agent, under Apache 2.0 on October 15. Its own tests found 0 escapes in 108 tries.
Dev Stack
ConnectWise Cloud Backup app abused to breach M365 tenants
Attackers used ConnectWise Cloud Backup's app identity to sign in to at least 162 Microsoft 365 tenants from October 15, 2026, Huntress says. No MFA stopped it.
Dev Stack
Palo Alto PAN-OS CVE-2026-0322 exploited for root access
Palo Alto Networks says CVE-2026-0322, a CVSS 8.6 PAN-OS flaw, is under very limited attack. It gives root on firewalls via the management interface.
Dev Stack
OpenCode Console breach exposes stored AI provider keys
OpenCode says a breach hit 1.4% of OpenCode Console users on October 17, 2026. Their stored OpenAI, Anthropic and Google API keys may have leaked.
Dev Stack
Replit CEO says it dropped Anthropic; insider disputes it
Replit CEO Amjad Masad said on October 16, 2026 that Replit no longer works with Anthropic, citing cost and performance. A source says the deal stands.
Dev Stack
SAP Cloud SDK for Python bug can leak OAuth2 secrets
A CVSS 10.0 flaw in SAP Cloud SDK for Python lets attackers redirect OAuth2 token requests and steal app secrets. Version 0.45.2 and later fix it.
Dev Stack
BeyondTrust Remote Support zero-day exploited since August
A China-linked group exploited a BeyondTrust Remote Support flaw from August 29, 2026. Self-hosted 26.2.3 and older need the BT26-05-RS patch now.
Dev Stack
GitHub license compliance is generally available
GitHub's open source license compliance became generally available on October 16, 2026, letting rulesets block pull requests that add unapproved licenses.
Dev Stack
Windows 11 KB5127648 bug grays out Smart App Control
After Windows 11's October update KB5127648, some PCs cannot turn Smart App Control back on. Microsoft lists a registry workaround while it works on a fix.
The weekly digest
One email every Friday with the week's top stories from all six desks: AI, dev tools, coding, the tech industry, startups and what's next. Free, no spam.