News
What happened, and why it matters.
Node.js Patched a Brotli Remote Code Execution Flaw on October 21. If Your Server Decompresses Anything, Check Your Version Before Lunch.
A bug in Node's bundled Brotli decoder allows remote code execution, and the fix shipped in 26.12.1, 24.22.1 and 22.23.4. There is no workaround, and older lines get no patch at all.
Anthropic Shipped Claude Duet, an Agent That Checks Your Apps Every Few Hours and Acts for You. Here's What It Replaces in a Solo Operator's Week.
Duet runs on its own virtual machine, connects to 6,000+ connectors, and can buy things with a virtual card. It is a waitlist preview for US Pro and Max, and the approval gates matter more than the feature list.
Meta's New Business Terms Take Effect October 30 and Let It Crawl Your Website. After Backlash It Dropped One Word, and the Crawl Right Stayed.
If you run ads, a Page, or any Meta business tool, the new commercial terms authorize crawlers on the domains tied to your account. Here's the robots.txt change to make before October 30 and what it won't protect.
PHP2Shell Hit Every PHP Since 5.4, and Exploit Attempts Started Four Days Before the Patch. Here's the 30-Minute Check for Your Servers.
Two unauthenticated RCE bugs in the PHP runtime itself were patched on October 21. Updating WordPress does not fix them, and the people who host client sites are the ones holding the exposure.
Walmart Opened a Gateway for Shopping Agents While Amazon Keeps Blocking Them. If You Sell Online, You Get to Pick Your Side First.
Walmart's Agent Gateway, announced October 21, lets AI agents buy within customer-set limits. Amazon stopped Meta's Muse agent in September. A small store should set its own agent policy before a platform sets it for them.
DHS Banned DeepSeek From Federal Agencies, and the Order Follows the Model Into Anything Built On It. Here's the 20-Minute Audit If You Sell to Government.
The order is not a ban on private use, but its reach into third-party products turns your model list into a procurement question. Here's what to inventory before a buyer asks.
Deno Just Joined Cloudflare. Deno Deploy Shuts Down in Six Months and the Runtime Has One Year Left. Here's the Exit Plan.
Cloudflare took the Deno team on October 9. Deploy closes in six months, the runtime gets about a year of fixes, and solo builders on either one need a plan now.
Next.js 16.4 Recommends Cache Components for Every App and Makes Them the Default in 17. ensureStatic Is the Part Solo Developers Should Care About.
Vercel's October 6 release adds a way to fail your build when a dynamic component sneaks into a page you wanted static. For solo hosting bills, that matters more than the new caching model.
A Federal Court Just Upheld the Pentagon's "Supply Chain Risk" Label on Anthropic. Here's What That Locks You Out Of.
The D.C. Circuit sided with the Pentagon on Anthropic in a 2-1 ruling. Here's the actual scope of the block, and why solo AI consultants should care even if they've never touched a government contract.
Microsoft Killed the Personal Copilot Chatbot. It Cut Health Questions and Custom Podcasts to Chase 30 Million Business Seats Instead.
Microsoft told a room of business leaders in Seattle it's done competing with ChatGPT for your attention, and gutted Copilot's consumer features to prove it.
Someone Just Shipped 'Ollama for Jev.' Ollaya Runs Seven Decision Models Locally and Answers in 8ms Instead of Metering You by the Token
Two days after I covered a 25-line hack that reimplemented TypeSafe AI's Jev locally, a proper packaged runtime called Ollaya showed up with an API-compatible server and zero per-token fees.
Oracle Invoked Force Majeure on Its $165 Billion AI Data Center Because New Mexico Can't Deliver the Gas on Time
Oracle told its own data center investors that pipelines and permits, not chips, are the actual bottleneck on the Stargate buildout. Here's what that means for anyone renting AI cloud capacity.