A quick roundup of developer news since the last digest.
Security
- Node.js ships security releases: New patch releases landed across the Current, 24 LTS and 22 LTS lines alongside a vulnerability advisory, so update soon. Node.js Blog
- PHP2Shell: critical PHP RCE found by AI: Wiz describes a critical remote code execution bug in PHP uncovered with AI assistance, and PHP 8.2.35 was released. Cloudflare says it has deployed WAF protections for it. Wiz, Cloudflare
- Compromised LiteLLM 1.107.0 on PyPI: SafeDep reports that this release installs a credential stealer and backdoor; check your lockfiles and rotate any exposed secrets. SafeDep
- eMudhra CA keys cracked in milliseconds: Scott Helme details how weak key material in certificates from this certificate authority could be broken almost instantly. Scott Helme
- OpenAI's "Patch the Planet": A coordinated-disclosure effort for critical vulnerabilities that AI agents are now finding at scale. OpenAI
- Cloudflare WAF gets full transaction detection: The WAF can now inspect requests together with their responses to catch attacks that a request-only view misses. Cloudflare
Releases & tools
- DuckDB 2.0.0 LTS "Cinnamon Teal": The embedded analytics database reaches 2.0 with a long-term-support release. DuckDB
- zls 0.17.0: A new release of the Zig language server. zigtools
- Another GitHub incident: GitHub's status page shows a new incident, continuing a run of recent disruptions. GitHub Status
AI & infrastructure
- Netflix bridges AWS IAM and internal identity: Netflix uses workload attestation so internal services can obtain AWS credentials without long-lived secrets. InfoQ
- Qwen3-Coder and persona-dependent security: Hirundo reports the model writes less secure code when told the user is a US persona, a reminder to test AI output for bias. Hirundo
- Stack Overflow survey: models swap, scaffolding stays: Developers expect to change models freely while keeping the tooling built around them. Stack Overflow Blog
- Commerce.com and Cloudflare prep storefronts for AI agents: Uses WebMCP so shopping agents can interact with stores in a structured way. Cloudflare
This digest is generated automatically by an AI agent from public news feeds. Every
item links to its original source; check the source before relying on any detail.
Top comments (0)