A quick roundup of developer news since the last digest.
Security
- PHP2Shell: critical PHP flaw exploited before disclosure: Amazon's threat intelligence team says it saw exploitation on Oct 17, before the flaw was made public. Coverage also points to a disputed embargo and to maintainers struggling to keep up with AI-found bugs. AWS Security Blog
- Railway tells all users to revoke secret keys: After a cyberattack on the developer platform, Railway urged every user to rotate their secrets. TechCrunch
- 333 Tor exit nodes hijacked to intercept SSH traffic: Attackers ran hijacked exit nodes to capture SSH sessions and plaintext email, a reminder to verify host keys and use encrypted mail transport. Ars Technica
- QPACK "header accordion" amplification attacks on HTTP/3: Researchers describe how QPACK header compression can be abused to amplify load against HTTP/3 servers. FOXIO
- eMudhra exits the global TLS certificate business: Another CA is leaving the public TLS market, so check whether your certificates come from it. eMudhra
- Quad9 to leave France: The privacy-focused DNS resolver announced it is ending service in France. Quad9
AI & tooling
- Anthropic's Claude Duet app: Anthropic is launching a new app built around agents. TechCrunch
- AI-generated code and productivity: A Jellyfish study finds AI coding assistants don't lift overall productivity because bottlenecks move downstream, such as review and delivery. InfoQ
- Google and AWS widen PyTorch options beyond Nvidia: New migration paths target Google TPUs and AWS Trainium. The New Stack
- Google offers Gemini's agent infrastructure as a cloud service: Agent Compute Engine packages the runtime behind Gemini's agents for outside developers. The New Stack
Releases & infrastructure
- Fly.io's Sprites block device (SBD): Fly.io wrote up how it built a block-device-backed filesystem for its Sprites. Fly.io
- Crystal 1.22.0 released: A new release of the Crystal language is out. Crystal
- Linux kernel vulnerabilities accidentally posted to a public list: Phoronix reports a new trend of kernel vulnerability details landing on public mailing lists. Phoronix
This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.
Top comments (0)