DevBackend

Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang

A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.

AGNTCon + MCPCon 2026: Agentic AI Foundation Adds Four Projects as MCP Turns to Security

At AGNTCon + MCPCon North America 2026, the Agentic AI Foundation added OpenSandbox, Open Responses, Agent Skills, and OpenEnv, reaching ten projects in its first year. Keynotes from Anthropic, OpenAI, Google, and UC Berkeley focused on MCP

OpenTofu 1.13 Lets Module Authors Reduce Unknown Values at Plan Time

OpenTofu 1.13 adds convert and assume... functions that let module authors give the planner type and value hints for unknown values, so more expressions resolve during tofu plan. If a value unknown during planning later violates a guarantee

DigitalOcean Launches Learning and Data Services to Enable Self-Improving AI Agents

DigitalOcean has announced the public preview of Learning Services and Agent Data Services, enabling developers to build, evaluate, and continuously improve AI agents within a unified, AI-native, cloud platform. By Sergio De Simone

Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out

Five expedited security releases to distrust the compromised eMudhra intermediate CA keys.

PHP Patches Two Critical RCE Flaws That Were Already under Attack

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities allowing unauthenticated remote code execution. Amazon recorded an exploitation attempt four days before the patches shipped, and operators spent the day wo

PyTorch Conference 2026: Google and Meta Open-Source TorchTPU for Native PyTorch on TPUs

Google and Meta open-sourced TorchTPU, a native PyTorch backend for Google's TPUs, at PyTorch Conference North America 2026, and Meta said it plans to move larger LLM workloads onto TPUs with it. AWS released TorchNeuron for Trainium the sa

Google ML Drift Accelerates On-Device AI Inference Across Diverse GPUs

Google has released ML Drift, an open-source, cross-platform GPU compute engine designed for on-device AI and machine learning inference. Licensed under Apache 2.0, it abstracts the complexities of different GPU hardware and low-level APIs,

A vision for a next-generation timeline

Slides: https://cfp.2026.matrix.org/media/matrix-conference-2026/submissions/WRGTRX/resources/sli_ZZVyXQu.pdf Comments

Google Optimizes Agent Development Kit's 200K-line Python Codebase Overnight with Gemini 4 Argon

Google explained how an 11-hour unattended run of Gemini 4 Argon produced two accepted optimizations for Google Agent Development Kit's codebase, reducing in-memory session-preparation overhead by about 40% in long sessions and cold package

Google’s Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM

Google has made Data Agent Kit generally available, a free set of MCP tools and 37 open-source skills that connect coding agents to more than fifteen Google Data Cloud services. Two kinds of guardrail ship with it, and practitioners need to

Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

400 points · 215 commentaires

Twelve years of distributed SQLite

Comments

Evolving Threat: http2shell is an RCE in Node, Python, and more

186 points · 95 commentaires

Railway Preliminary Report: Oct 21st Security Incident

Comments

Origin Range Requests: Serving large files without range-request tuning

Naive byte-range caching can waste gigabytes of origin bandwidth on small requests. We rebuilt our cache architecture in Pingora to coordinate partial fetches automatically, cutting R2 p99 latency in half.

Bringing post-quantum cryptography to geographically fenced key management

Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.

The Hibernate Origin Story (Outsider Edition)

Comments

UUIDv7 doesn't have the properties you think it does

Comments

The HTML-in-Canvas API origin trial

123 points · 63 commentaires

Expose only share links of a private service with caddy

Comments

Localizing compliance at scale: achieving South Korea’s ISMS certification

Cloudflare has achieved South Korea's ISMS certification following an audit across 80 controls. Learn how we localized user consent flows, adapted social sign-up paths at the edge, and validated our global security program.

The bridge to agent-scale Git infrastructure

Comments

Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”

Comments

Railway Security Disclosure: Wednesday October 21st

Comments

Wednesday, October 21, 2026 Security Releases

Introducing full transaction detection for Cloudflare WAF

Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data exposure, and risky misconfigurations that request-only inspection can

Cloudflare deploys protections against php2shell vulnerability

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from r

Node.js 26.12.1 (Current)

Node.js 24.22.1 (LTS)

Node.js 22.23.4 (LTS)

Unauthorized Access to PingCAP Cloud Resources

Comments

Python 3.15.1, 3.14.9 and 3.13.17 are out

Three certified security releases for 3.15, 3.14 and 3.13.

Postgres 19 RC1 and what to test now

#​670 — October 21, 2026 Web Version Postgres Weekly Postgres 19: What Changed and What to Test Now — With RC1 out and GA due in under a month, Tom Kincaid walks through what survived the reverts and what to try before upgrading, including