Cloudflare halves DNS build delay with targeted zone builds and cuts peak memory by 85%
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
Victoria Shinder
Contributing writer
Writes for Dev News Daily on the parts of software work that are not code: process, release discipline and what teams actually do with a change.
Signed pieces
An email address gave code execution on GNU Savannah, home of Bash
Hacktron's write-up shows how a backtick payload in the account email reached a shell, then superuser, maintainer impersonation, root and a backup server; the FSF fixed 26 reported flaws.
GitHub adds three webhook delivery IP ranges to its Meta API
Teams with a hand-maintained allowlist need to add 9.234.98.160/28, 9.234.98.176/28 and 9.234.106.48/28 or risk rejecting deliveries; allowlists fed from the API need nothing.
Northflank breach: customers told to treat all env variables as exposed
The platform's status page says users report unauthorised use of AI API keys stored there; Northflank has enabled secret rotation for Postgres and MongoDB and audit logs for all accounts.
Quarkus Almanac diffs any two releases by config, BOM and class API
Modelled on the Java Version Almanac, it covers every Quarkus release from 0.0.1, reads the class files in every jar and updates itself from Maven Central every twelve hours.
A read-only AI reviewer invented a CVE, and no permission was broken
Docker's account of a code review bot that rejected a routine PostgreSQL bump with a fake CVE shows where agent safety stops: the agent obeyed its limits, and the risk moved to the person reading its output.
Mistral Large 4 ships as open weights: 1T MoE, 49B active, 1M context
The model announced in early October is now downloadable; Mistral pitches it at defensive security, with 82% on Artificial Analysis' Cyber Index and a licence that limits model-as-a-service use.
Spring AI 2.1 stores messages as ordered parts so model reasoning survives replay
Claude signatures, Gemini thought signatures and OpenAI encrypted reasoning are now replayed unchanged; the change is backward compatible but code that reads reasoning may need updating.
JetBrains IDE terminal switches from JediTerm to libghostty in 2026.3
Kitty keyboard protocol, theme-change notifications and almost 50 newly handled control sequences arrive; Shift+Enter now inserts a newline in CLI agents instead of sending the prompt.
LLMs now out-find fuzzers in V8, while most CIOs cannot see their own dependencies
Project Zero counts 45 BigSleep bugs against 37 from Fuzzilli with 25–60% overlap; a Red Hat survey finds only 32.9% of EMEA CIOs have a complete view of their open source supply chain.