GitHub postpones the cut-off for pull_request_target to December and schedules two brownouts
Enforcement was due on 2 November; GitHub now plans two-hour brownouts on 9 and 16 November, during which affected workflow runs will fail.
News Feed
Everything we have published, newest first, from every desk.
AWS capacity sold out through 2027? What Andy Jassy said, and what it means for on-demand users
Amazon's CEO said committed capacity is largely allocated through 2027 with headroom kept for on-demand, EC2 and Bedrock; engineers report tighter ordinary instances already.
KDE gets Kwi, a new GPU-rendered terminal emulator built on libghostty-vt
Announced on 1 November, Kwi pairs the Ghostty project's terminal library with KDE Frameworks and Kirigami; its author reports 3x to 35x faster results than Konsole.
SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw
Johannes Ullrich's diary walks through the MPTCP option, its subtypes and where it shows up in practice, mainly iOS connections to Apple's 17.0.0.0/8 range.
Cloudflare halves DNS build delay with targeted zone builds and cuts peak memory by 85%
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
OpenAI raises bug bounties: critical flaws in ChatGPT, Codex and the API pay up to $30,000
OpenAI says it is more than quadrupling the midpoint of its medium, high and critical reward ranges and adds quality, loyalty and campaign bonuses.
pgAdmin 4 v9.19 fixes 15 vulnerabilities, most of them in server mode
The 31 October release patches CVE-2026-116238 to CVE-2026-116252, replaces free-text password exec commands with an allowlist and adds an extended-statistics node.
Hono 4.13.16 fixes five ways a request could slip past middleware
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.
Linux 7.2.15 is the last 7.2 release; the branch reaches end of life early
Greg Kroah-Hartman told users to move to 7.3.y, saying keeping 7.2 alive would have meant maintaining eight stable branches at once.
An email address gave code execution on GNU Savannah, home of Bash
Hacktron's write-up shows how a backtick payload in the account email reached a shell, then superuser, maintainer impersonation, root and a backup server; the FSF fixed 26 reported flaws.