Docker updates PHP images for critical PHP2Shell flaws

Also

PyTorch showcases native TPU and Trainium backends — TorchTPU brings eager execution and torch.compile to Google TPUs; TorchNeuron launches in public beta for AWS Trainium, expanding hardware choices.

Prisma details rotation after Railway incident — Railway is investigating possible unauthorized access to customer environment variables. Creating a replacement Prisma Postgres credential does not invalidate the old password.

AWS Continuum reaches GA — The service tests vulnerabilities in isolated sandboxes and opens fixes as pull requests, helping developers distinguish exploitable findings from scanner noise.

Ollama adds Phonon text-to-speech on macOS — The streaming endpoint works with existing OpenAI SDK code after a base-URL change. The 40M models are limited to noncommercial use.

Modal launches Spindle’s training-server beta — The open-source, Tinker-compatible server bills GPU time, not tokens. Modal reports 80% lower output-token costs than Tinker in one math-training benchmark.

SageMaker AI adds GA training-session APIs — Developers can run custom training loops against a live session while AWS manages GPUs and recovery. Billing counts processed tokens, not local reward-scoring work.

TanStack AI stabilizes its core APIs — Version 1.0 is production-ready, but the new agent harness remains experimental. With persistent storage, interrupted harness turns can resume on another host.

Cloudflare opens Origin Range Requests to all plans — Chunk-aligned fetches curb overfetching: under R2’s old scheme, a small read crossing a range boundary could move 128 MiB between data centers.

Supabase adds an MCP Server block for apps — Tool calls run as the signed-in user, so existing row-level security policies govern what external agents can access.

OpenAI’s Decisions API reaches GA — It makes near-real-time decisions with GPT-6 Luna. In Box’s 30-case insurance evaluation, routing was about five times faster than the Responses API with the same accuracy.

OpenAI details Habitat’s caching and Rust overhaul — The changes cut global median read latency from roughly 120 ms to 10 ms; cache invalidations propagate worldwide within seconds.

vLLM serves million-token GLM-5.3 contexts — with context parallelism and Hybrid HiSparse across 16 H200s.

vLLM accelerates DeepSeek-V4.1-Flash serving — a specialized decode path reached 826 P90 tokens per second for one user on four B300 GPUs.

Mastra adds experimental MCP events — servers can push updates to subscribed clients without a separate pub/sub service.

GitHub restores deleted Enterprise Managed User records — October’s repair covers roughly 12,285 accounts wrongly deleted during June SCIM deprovisioning.

Releases

• pydantic-ai 2.61.0structured citations and provider-aware history, bounded Shell logs, public durable engine hooksminor
• fastapi 0.162.0omitted bool fields respect declared defaults, required form booleans raise missing-field errorsminorbreaking
• @openai/codex 0.164.0prompt presets, inline /model and /permissions, fullscreen image previews, enterprise MCP sign-inminor
• pydantic-ai 2.60.0local DockerSandbox and BoxLiteSandbox workspaces, judge-ranked RelevanceCompaction, plain-English SmartSearch, FileUnderstandingminor
• convex 1.48.0JWT signing via ctx.auth.signJwt, mutation storage access, agent env lists hide valuesminor
• fastapi 0.161.0combining unions of form modelsminor
• fastapi 0.160.0parameter models apply extra to sibling fields, forbid rejects, allow includes, ignore ignoresminorbreaking

Conferences