CVE-2026-85706 is a GitLab path traversal vulnerability with a CVSS score of 10.0, affecting multiple versions of self-managed GitLab CE/EE from 18.7 to 19.3.1. Unauthenticated attackers can read arbitrary files on the server via the /api/v4/projects/{id}/repository/commits/ interface. The vulnerability has been actively exploited, and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog. GitLab released a patch on September 11, which was subsequently backported to end-of-support versions 19.0.9 and 18.11.12. It is recommended to search logs for POST requests containing file.path parameters and rotate CI/CD variables, deployment tokens, and SSH keys.
In an exclusive interview with Huxiu, Hesai CEO and Sharpa co-founder Li Yifan pointed out that Sharpa is not merely a dexterous hand company, but an embodied AI enterprise focused on "brain + body" full-stack collaboration. Its first commercial deployment scenario is a robotic ice cream shop partnership with DQ in August 2026, achieving complete operations such as cup retrieval, ingredient addition, stirring, and pouring without spillage. Li Yifan emphasized that real environments, continuous reliability, and end-to-end task closure are the core standards for verifying capabilities, opposing defining strength solely through demos or papers, and frankly stated that full-stack development is a necessary choice to break through technical boundaries at the current stage.
OpenAI upgraded the ChatGPT Chrome extension to allow it to view and operate currently open browser tabs after user authorization, supporting tasks such as comparing product information, filling out forms, organizing comparison tables, drafting emails, and adding schedules. It also updated sidebar features to integrate full ChatGPT capabilities and conversation history, and granted ChatGPT Work the ability to control tabs to perform operations such as sending messages, filling out forms, and downloading files.
ƜackDown is a native Markdown viewer for Windows, with a single file size of approximately 3.2 MB. It does not rely on browser engines, does not connect to the internet, requires no account, and starts extremely quickly (first-screen layout takes about 2 milliseconds). It supports GPU-accelerated rendering (Direct2D/DirectWrite), 6 themes, embedded Iosevka fonts, live reload, Unicode rendering for mathematical formulas, common extensions (tables, task lists, footnotes, wiki links, etc.), and code blocks with horizontal scrolling and syntax highlighting. It only supports 64-bit Windows, does not offer open-source editing features, and stores configuration in a single JSON file under %APPDATA%. The project is human-led with Claude Code assisting development, and the code is licensed under GPL-3.0.
IBM and Hugging Face released the Granite Switch 4.1 models, including the Granite-Switch-4.1-8B and -30B versions. By integrating the Decision aLoRA, Guardian aLoRA, and Granite-Speech-5.0-Turbo-CTC ASR models, they enable efficient switching between natural language responses, general/safety-specific decision-making, and speech-to-text tasks on a single hosted endpoint; all adapters share the base model's KV cache, resulting in inference overhead close to that of a single base model, and it is faster than Jev-27B in real RAG workflows; users can customize adapter combinations based on Granite Libraries, and an official Adapter SDK is planned.
Parallax is an integrated development application that supports 40+ coding agents including Claude Code and Codex, connecting to 240+ models via users' own subscriptions. It offers Captain for automatically handling chores, Fast Merge for one-click PR merging, and automatic fallback model switching when subscriptions expire.
At TechCrunch Disrupt 2026, Bluesky announced an expansion of its AI tool Attie, adding capabilities to build interactive experiences such as websites, quizzes, games, and polls; this feature is based on the AT Protocol (atproto), allowing users to develop using their own or open-source AI models, with generated content directly integrated into the Bluesky network; Bluesky CEO Toni Schneider described it as "vibe coding for the community," while COO Rose Wang emphasized its built-in Bluesky distribution capability, noting that the current network has 47 million registered users.
RDST is a locally running agent that connects to PostgreSQL or MySQL databases in read-only mode. It reads real query statistics from pg_stat_statements or performance_schema every minute, automatically identifies queries that have slowed down, surged, or become ineffective, and recommends specific repair actions such as adding/removing indexes, adjusting configurations, rewriting SQL, or executing vacuum based on EXPLAIN plans and schema analysis. All fixes include estimated time savings, lists of affected queries, step-by-step execution SQL for various cloud platforms (RDS/Aurora/Cloud SQL/Azure), and corresponding rollback statements. The desktop version is based on Electron, while the CLI is implemented in Python, supporting one-click installation on macOS/Linux. Data and passwords are kept entirely local; AI features only upload SQL text, execution plans, and schemas, without uploading table row data.
The GitHub engineering team released a GitHub App named Evergreen, which automates organization-level repository governance through two major workflows: quarterly external collaborator permission reviews and idle repository detection and archiving. Built on native GitHub features (Apps, Actions, webhooks, issues, custom properties, git file storage), it adheres to fail-secure and never-delete principles. All state changes are recorded in git-blameable JSON files, and human decisions are driven by checklist issues within the repository.
Meta has released Muse Spark Open, a coding-optimized open-source large language model. It supports a 1000000-token context window, multimodal input (text/image/document/audio/video), and reasoning-based output. It adopts a MoE architecture (816B total parameters, 42B activated per token). It can now be directly deployed as a real-time endpoint in Amazon SageMaker JumpStart. Two quantization variants are provided: BF16 and NVFP4, adapted for ml.p6-b300.48xlarge and ml.p5e.48xlarge instances respectively. Deployment requires acceptance of the Muse Model License.
In its Gemini 4 Argon safety report, Google DeepMind noted that as of September 2026, no significant end-to-end acceleration had occurred in its ML R&D, with the capability index GCI growing steadily by approximately 0.1 points per month; although over 75% of production code was written by AI, approximately 88% of code changes still required multiple rounds of human guidance or were personally written by humans, and Gemini 4 Argon completed only about half of internal research engineering tasks.
llama.cpp v0.7.0 has been officially released. Key updates include: a new host memory GPU cache for MoE experts (--moe-cache-mib), improving decoding speed by up to 2.2x; introduction of LiliCorr speculative decoding technology and MTP speculative decoding for GLM5-Next; support for new models such as EmbeddingGemma-2 (text + visual + audio embeddings), MiniCPM-V 4.7, and Nemotron Super 3.5 VL; server-side refactoring of the chat session API, changing the default port to 9931, and enhanced prompt cache recovery behavior; addition of a full-featured model manager to the Web UI; and ggml upgraded to v0.27.0.
VX v0.0.638 has been released. This is an open-source build tool developed by an independent developer, featuring AI-agent friendliness, a daemonless architecture, fast caching based on Git index, and a pluggable task graph. It supports commands such as vx run, vx last, and vx why, with all outputs in JSON format. In a synthetic monorepo benchmark test involving 1601 projects, the cold build time was 7.73 seconds, faster than Turborepo (10.32 seconds), Nx (3 minutes 23 seconds), and Vite Task (9.44 seconds). The project team states that it is designed specifically for agents; running npx skills add vznjs/vx allows coding agents to learn its CLI.
Toad is an independently developed MCP service that supports MCP clients such as Claude, Claude Code, and Cursor in running commands and manipulating files across all of a user's machines. It requires installing a lightweight service on each machine, needs no open ports, and requires manual user approval for every change.
Ross Shaw released BlastLoop 1.0.0, a structure-first programming framework for AI agents that defines three coding altitudes—Blast (system level), Mid (subsystem level), and Inner (local unit level)—and a fixed-order test loop consisting of T1 structural tests, T2 defect/operations tests, and T3 adversarial tests; it provides a complete set of Prompt files, handoff rules, and comparison documentation, is licensed under MIT, and the open-source repository is live.
Sygal is a local document conversion tool released by an independent developer from Paris. It supports converting PDFs, Word documents, Excel files, web pages, scanned images, and YouTube links into clean Markdown and structured JSON. All processing is completed 100% on-device. OCR options include providers such as OpenAI, Claude, Mistral, NVIDIA NIM, or Gemini, using the user's own API keys. Desktop applications for macOS 12+ and Windows 10+, as well as a CLI, are available. The price is a one-time purchase of €25, including a 14-day free trial.
The Verge reported that Meta's AI personal assistant Muse encourages users to grant it access to highly sensitive data such as bank accounts, passwords, contacts, and chat records through anthropomorphic virtual avatars and inducement-based interface design, building real-time profiles of users and their social circles based on this data; although Meta claims that data sharing is entirely based on user active selection and public information, security researchers found that it updates acquaintance profiles hourly, and incidents such as misreading text messages and leaking home addresses have already occurred; multiple privacy experts criticized its reliance on long-invalidated click-through consent mechanisms, shifting privacy responsibility onto ordinary users, while tech companies can neither explain system behavior nor assume substantive security obligations.
SemiconFab.org has released an open-source semiconductor fab digital twin platform running in standard browsers. It supports cleanroom building-level modeling for 300mm (12-inch) fabs, engineering classification of 121 OEM equipment types across 13 process categories, 8-tier cascaded yield simulation, SEMI E10 real-time telemetry, and STDF V4 data log parsing. The platform includes the MIMAC-2026 scheduling benchmark suite, digital twins for 5 nanoscale devices (such as GAA FETs and HBM3E), 3D visualization of ISO Class 1 cleanrooms, and requires no installation or dedicated CAD software.
Google DeepMind has released the Antigravity agent platform, providing an end-to-end scientific workbench for biologists that supports rapid discovery, structural evaluation, and prioritization of antimicrobial peptide (AMP) candidates. The platform integrates the ProtNLM model, which can predict functions for millions of unannotated protein sequences in UniProt, and embeds the Biomolecular Structure Viewer 3D visualization tool to enable real-time collaboration between researchers and agents on shared 3D structures. The article demonstrates the platform's ability to identify a novel bacteriocin candidate in Streptococcus pseudopneumoniae awaiting wet-lab validation.
The AMD ROCm official blog published a detailed tutorial guiding developers on how to write high-performance FP16 GEMM kernels for RDNA 3 (gfx1100/gfx1151) and RDNA 4 (gfx1201) GPUs.
Shopify Flow has added an automatic shipping label purchase feature. Merchants can set order trigger conditions (such as specific tags, products, single-item orders, etc.), specify the carrier, service type, package type, weight, and ship date. Matching orders will automatically generate labels displayed on the Shipping labels page for printing; non-matching orders are unaffected. Users can quickly enable this via ready-made workflow templates.
Microsoft Research released Magnetar, a zero-knowledge proof-based general-purpose virtual machine (zkVM) that supports direct proving of programs written in Rust, Go, and C executing on the RISC-V architecture. Proof generation is 10–39 times faster than the fastest existing comparable zkVMs, with verification taking approximately 12 milliseconds. Security relies solely on standard hash functions such as SHA-256 or SHA-3, requiring no trusted setup, elliptic curves, lattice assumptions, or unverified coding conjectures.