CloudFront can now tell an origin the viewer's ISP and whether TLS used PQC
Two new optional headers, CloudFront-Viewer-ISP and CloudFront-Viewer-TLS-Details, are forwarded to the origin through an origin request policy.
News Feed
Everything we have published, newest first, from every desk.
Twelve frameworks, one app: agent build cost ran from $2.67 to $4.97
Nolan Lawson had a coding agent build the same Pokémon app five times per framework; Lighthouse scores barely moved, while build cost and shipped JavaScript differed widely.
Trigger.dev says an attacker read environment variables of some customers
The company disclosed on 1 November that the exploit is blocked, a subset of organisations had their environment variables exposed and affected owners were emailed.
ChatGPT and Codex will share one token-based usage allowance from December
OpenAI says Plus, Pro and Business plans will draw ChatGPT and Codex use from a single allowance measured in tokens; Instant chat will not count against it.
GitHub adds three webhook delivery IP ranges to its Meta API
Teams with a hand-maintained allowlist need to add 9.234.98.160/28, 9.234.98.176/28 and 9.234.106.48/28 or risk rejecting deliveries; allowlists fed from the API need nothing.
Linux multipath TCP bug allows remote root; Go servers use MPTCP by default
CVE-2026-98432 is a race-induced use-after-free reachable by packets alone; the fix frees the structure after an RCU grace period and is in the maintained stable kernels.
PostgreSQL 19 slips to November, and a core developer blames LLM-found bugs
Robert Haas counts back-patched commits up more than 60% on last year and late reverts of three large features; the cause, he argues, is that bugs became much easier to find than to fix.
Northflank breach: customers told to treat all env variables as exposed
The platform's status page says users report unauthorised use of AI API keys stored there; Northflank has enabled secret rotation for Postgres and MongoDB and audit logs for all accounts.
Node.js 27 alpha: V8 15.6, OpenSSL 3 required, a new default heap limit
The first alpha changes the default heap ceiling, counts Buffer memory against it, switches v8.serialize to a format older releases cannot read and removes the bundled FIPS provider.
Rails this week: no CSRF tokens under header_only, lazier test gems
New apps stop loading Capybara and Selenium on boot, the :header_only CSRF strategy no longer renders tokens, and four fixes land for preloading has_many :through associations.