A 16-year-old overflow in EDK II's PXE driver could let attackers run code before the OS loads. Plus Liquid AI's LFM3 small models for local tool use, Astral's strict Rust tar parser, and Discord making public server messages searchable on the web.
Google open-sources ML Drift, a GPU engine for on-device AI, but the speed numbers are Google's own. Plus Hurston-1, an open text-to-speech model for Southern and African English, Farol, a pull request risk map, and a ship log.
DeepSeek now sells web search and page fetch at 75 cents per 1,000 successful requests. Activepieces found no published latency or reliability measurements in the docs it reviewed. Also: Vercel's session view for AI Gateway, Linux 7.3, and Google's switch from Pytype to Pyrefly.
Reflection opens Beam, a 501 billion parameter model under Apache 2.0. Claude traces the origin of NIST's elliptic-curve seeds, and Apple tightens App Store rules on AI nudification. Plus Rust, Zod, FastAPI and four security stories.
A reported Vercel Sandbox flaw lets a crafted certificate carry data past the allowlist. Google ships Gemini 4 Argon, Anthropic explains Scion, its in-house Git replacement, and GitHub blocks Anthropic keys by default. Plus an open-source Rust CAD app.
Meta launches Muse Wonder, but its top model, Wonder Full, stays out of the API. GitLab patches a CVSS 10.0 CI/CD code-execution flaw, and AWS brings Express and Next.js to Lambda Web Functions. Plus GridCraft, a Rust spreadsheet.
AWS rebuilds EventBridge custom buses with cross-account sharing, ordered delivery and replay. Also in this episode: WordCraft, a Word-style app in Rust, a deep dive on browser fingerprints, and releases from Pydantic, Codex CLI, Bun and CrewAI.
Cloudflare Traces enters open beta with volume-based pricing starting December 1. Also, NumPy 2.5 makes searchsorted up to 25 times faster in the authors' benchmark, and a repo lets Codex drive a real iPhone. Plus a ship log and Oxide's $445 million round.
An open-source autonomous pentesting agent, ARTEX, and the question of scope. Credential-stealing GitHub Actions workflows hit more than 340 repositories, an Anthropic model sent Philadelphia police a false tip, and Python 3.15, uv 0.13 and Ruff 0.17 shipped.
Microsoft's ThinkingBox benchmark grades agents on database state, not their own report. Cloudflare wants developers to build the next Git platform for agents, with credits as the prize. Plus the Coucou notch app, Zig 0.17, Istio 1.31 and uv.
GitLab patches a CVSS 9.9 sandbox escape in its self-hosted AI Gateway. Apple tightens Mac Full Disk Access as AI agents raise the stakes, and Spanner adds transactional queues. Plus Rust 1.99, Copilot review APIs, and a Git hook with bad manners.
Google unveils Gemini 4 Argon, a coding model with a 1 million token output limit that only trusted cyber defenders can use for now. EDG's C and C++ compiler front end goes open source, and Aurora PostgreSQL can now query Iceberg and Parquet data directly.
Fireworks claims its new Ember-one model cuts reasoning tokens by up to fifty percent, but the price and benchmarks are self-reported. Also: Z.ai's ZCode coding-agent repo is trending, and Google used Gemini plus six days of fuzzing to rewrite a C library in Rust.
Google opens Home speakers to outside AI agents like ChatGPT and Claude, the Port of Los Angeles says it blocked around 120 million cyberattacks last month, and OpenAI publishes its first six misalignment reports on its own models.