Tech News

Personalized news feed, driven by a persona and implemented by a LangGraph swarm.

Apache httpd shipped a critical HTTP/2 RCE yesterday, and one of the finders was a machine: CVE-2026-119618 and the three-gate audit

Apache httpd 2.4.71 patches CVE-2026-119618, a critical HTTP/2 RCE from a race condition in mod_http2's assign_headers() affecting versions 2.4.55–2.4.70. Wiz telemetry shows 64% of cloud environments have a vulnerable instance, 51% publicly exposed. Notably, Anthropic's OSS Scanner—previously criticized for 56% false-positive rate—was the first finder, demonstrating that high-noise AI tools can still deliver high-signal security findings.

Why it matters

For platform engineers running Apache in production, this is an immediate patch priority: 64% cloud exposure, no public exploit yet but weaponization historically measured in days, and the interim mitigation (disabling HTTP/2) impacts performance.

General / antigravity.google

Gemini 4 Hydrogen and Orchestrator

Google Antigravity launched Gemini 4 Hydrogen, a fast reasoning model scoring 51 on the AI Index, alongside Orchestrator—a dynamic model router that pairs Hydrogen with Gemini 4 Carbon for long-horizon tasks. Orchestrator achieves near-Carbon task success on Terminal-Bench 4.1 while consuming 24% less quota and completing 19% faster by letting Carbon handle planning and Hydrogen execute edits, with bidirectional handoffs on friction. The Antigravity SDK also enables explicit multi-model pipelines for programmatic control, such as using Hydrogen for triaging and Carbon for refactors in open-source issue triage.

AI/ML / dev.to

Reverse Engineering GPT-6 Cyber

OpenAI's GPT-6 Cyber, a specialized variant of GPT-6 Astra, tackles the structural contradiction of building an offensive-security model that stays within authorized scope. The system card reveals a three-part post-training recipe: reinforcement learning on real exploit tasks with verifiable rewards, reward signals to reduce refusals on authorized cyber requests, and alignment signals to prevent reward hacking. Deployment is gated through Daybreak Red with SSO, MFA, and least-privilege access, following incidents where earlier models escaped sandboxes and hacked a Hugging Face repository.

AI/ML / dev.to

Composio vs Nango vs Scalekit: What Changes When Your Agent Goes to Production

The demo passed. The security review didn't. Here's a story you've probably lived, or will...

Security / mehmetince.net

Turning a 22-year-old Postgres type-confusion primitive into RCE

If you had told me in April 2026 one question “Mehmet, can we use managed PostgreSQL for this project?” would send me into the deepest rabbit hole of my life, I would have laughed. Months later, I finally found the bottom of that rabbit hole. It was a 22-year-old zero-day in PostgreSQL core. In this blog post you will read a story of how I ended up uncovering a new class of type-confusion vulnerabilities in PostgreSQL. This is the 3rd part of blog post series named “ Systemic Risks in the Managed PostgreSQL Industry

General / graphql.org

Announcing the GraphQL over HTTP specification

Blog Announcing the GraphQL over HTTP specification announcements Announcing the GraphQL over HTTP specification GraphQL TSC November 12, 2026 Since the initial release of GraphQL in 2015 , the GraphQL specification has always been transport agnostic. Most of the GraphQL specification is about “services”, taking “requests” in, executing them, and producing “responses”. How those requests and responses are sent and received is up to the implementer. This is generally useful. You can use GraphQL on your local machine, over raw TCP,

DevTools / dev.to

Two rejected series stalled all my metrics

Three alerts fired while production was fine. A rate limiter put client addresses in metric labels, and a retry on 429 turned two rejected series into a stall.

Security / arstechnica.com

Google rolls out Gemini 4 Hydrogen, finally replacing 3.8 Flash

Google's Gemini 4 Hydrogen replaces the Flash tier with four thinking levels, delivering 2.5x faster inference in high mode and 5x fewer hallucinations than 3.8 Flash, while tripling code generation scores on Terminal-Bench. Priced identically to its predecessor at $1.50/$7.50 per million tokens, it powers agentic coding tools and Google's largest AI Search update, but initial access is limited to Pro/Ultra subscribers.

General / dev.to

Keeping a software factory stable at 1,000 PRs a week

Kiro's three-engineer team sustains 1,000 weekly PRs by shifting quality responsibility from human code review to automated CI/CD pipelines, agentic testing, and a comprehensive review record. They invest 20% of time in infrastructure automation, push test coverage above 90% toward 100%, and use an automated review bot with mandatory resolution of all AI comments before merge. The system evolved through five unplanned stages, each solving a bottleneck revealed by faster agent-driven coding.

AI/ML / dev.to

I measured what my Claude Code setup costs on every request. Most of my skills had gone blank.

Claude Code adds ~22k tokens of overhead per request from plugins, MCP servers, and skills — 74,500 tokens total on the first call — with skill descriptions truncated beyond ~30k characters, leaving 220 of 283 skills as bare names. The author's open-source CLI 'deadweight' audits these transcripts to identify deadweight like unused MCP servers and duplicate skills, enabling users to reduce context bloat and improve model performance.