News
What happened, and why it matters.
A GitHub Issue Claims Claude Code Puts Your Email in the User-Agent Header. It Is Unverified. Here Is How I Would Check My Own Traffic.
One user report, no packet capture and no response from Anthropic yet. The useful move is a ten-minute test of what your agent tools send, whatever the answer turns out to be.
Go 1.27 Put encoding/json on the v2 Engine. The Blog Post Landed November 4. Here Is What Changes and What Does Not.
Unmarshal is up to 10x faster in the Go team's benchmarks, v2 has stricter defaults, and v1 is supposed to behave the same. The risk sits in where you import v2 directly.
Meta Bought Conductor and Its Cloud Goes Read-Only November 13. What a Nine-Day Warning Teaches About Building on Small AI Tools.
Conductor, the parallel-agent coding app, announced it is joining Meta. No new signups since November 4, cloud chats go read-only November 13, and cloud data deletion starts November 20.
OpenSSH 10.6p2 Patched a Password Bypass on musl Systems. If Your Containers Run Alpine With Password Logins On, Here Is the Two-Minute Check.
A password longer than 256 characters can get past sshd for accounts locked with an asterisk, but only on a specific build. The fix shipped November 5, and the mitigation is one config line.
Postman's Desktop App Installed Plugins Into Claude Code and Codex Without Asking. Here Is the Five-Minute Audit of Your Agent Config.
A GitHub issue says opening Postman 12.33.4 added a plugin, a session hook and an MCP entry to two coding agents. No data theft is shown, but your agent config is now a place other apps can write to.
Safari 27.3 Will Auto-Darken Light-Only Sites. Declare Your Color Scheme Before Users Meet Your Site Inverted.
WebKit announced Adaptive Dark Mode on November 3. If your site ships only light styles and says nothing about color-scheme, Safari may recolor it for users who switch the feature on.
China Proposed Export Controls on 23 AI Technologies, Including Weights for Models Over 2 Trillion Parameters. Hosted APIs Are Exempt. Here Is the Dependency Check I'd Run Before It Is Final.
Weights you already downloaded are untouched. The risk is that the next frontier-scale open release from a Chinese lab never ships, or ships late.
Ubuntu Still Has No Fixed Kernel for CVE-2026-98432, a 9.8-Scored TCP Use-After-Free With No Public Exploit. Here Is the Triage I'd Run on a Single VPS.
The upstream fix landed October 15 and Debian has shipped, but Ubuntu's tracker still shows work in progress. A calm read of what the score does and does not mean for a one-server operator.
Postgres 19 Slipped Into November Because LLMs Keep Finding Old Bugs. Back-Patches to Supported Branches Are Up About 74%. Patch Your Minor Version This Week.
A PostgreSQL contributor says the release is late because AI finds bugs faster than people can fix them. If you run a database alone, the lesson is about minor versions, not the new release.
Trigger.dev Disclosed on November 1 That an Attacker Read Environment Variables for a Subset of Customers. Here Is the One-Hour Rotation Drill I'd Run on Any Platform.
The incident report is short and leaves most questions open. That is the point: whatever you store in a hosted platform's env vars is only as safe as that vendor's worst day.
Apple Is Putting Alibaba's Qwen Inside Apple Intelligence in China. The iOS 27.3 Beta Lands November 4, So Test the Regional Fork Now.
Apple confirmed a China edition of Apple Intelligence with Qwen behind parts of it. Testing starts November 4, public release is December, and no one has published developer details.
DeepSeek Started Charging $0.75 per 1,000 Search Calls on November 1, Including the Ones Claude Code Makes. Check Your Setup Before the Bill Does.
The free window on DeepSeek's Search and Fetch API closed at midnight Beijing time on November 1. If you route Claude Code or Codex through DeepSeek, a meter you never saw is now running.