Languages
Rustup 1.29.3 fixes an illegal-instruction crash on x86_64 CPUs without SSE4.1
The point release repairs two regressions from the previous version; rustup updates itself with rustup self update or at the end of rustup update.
Dev News Daily — Software news, read and annotated by a working engineer
AWS capacity sold out through 2027? What Andy Jassy said, and what it means for on-demand users
Amazon's CEO said committed capacity is largely allocated through 2027 with headroom kept for on-demand, EC2 and Bedrock; engineers report tighter ordinary instances already.
KDE gets Kwi, a new GPU-rendered terminal emulator built on libghostty-vt
Announced on 1 November, Kwi pairs the Ghostty project's terminal library with KDE Frameworks and Kirigami; its author reports 3x to 35x faster results than Konsole.
SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw
Johannes Ullrich's diary walks through the MPTCP option, its subtypes and where it shows up in practice, mainly iOS connections to Apple's 17.0.0.0/8 range.
Cloudflare halves DNS build delay with targeted zone builds and cuts peak memory by 85%
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
OpenAI raises bug bounties: critical flaws in ChatGPT, Codex and the API pay up to $30,000
OpenAI says it is more than quadrupling the midpoint of its medium, high and critical reward ranges and adds quality, loyalty and campaign bonuses.
pgAdmin 4 v9.19 fixes 15 vulnerabilities, most of them in server mode
The 31 October release patches CVE-2026-116238 to CVE-2026-116252, replaces free-text password exec commands with an allowlist and adds an extended-statistics node.
Hono 4.13.16 fixes five ways a request could slip past middleware
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.
Linux 7.2.15 is the last 7.2 release; the branch reaches end of life early
Greg Kroah-Hartman told users to move to 7.3.y, saying keeping 7.2 alive would have meant maintaining eight stable branches at once.
An email address gave code execution on GNU Savannah, home of Bash
Hacktron's write-up shows how a backtick payload in the account email reached a shell, then superuser, maintainer impersonation, root and a backup server; the FSF fixed 26 reported flaws.
CloudFront can now tell an origin the viewer's ISP and whether TLS used PQC
Two new optional headers, CloudFront-Viewer-ISP and CloudFront-Viewer-TLS-Details, are forwarded to the origin through an origin request policy.