Node.js 26.8.2 (Current), released 9 September 2026 by Antoine du Hamel, updates Undici to 8.10.2, OpenSSL to 3.5.8, npm to 11.19.1 and corepack to 0.36.0. The release also deprecates the internal Server.prototype._liste…
Google has released Chrome 153, switching stable and beta channels to a two-week release cadence. The update patches 230 vulnerabilities, including an actively exploited out-of-bounds write in the V8 engine. Enterprise E…
Microsoft's September 2026 patch release fixes a record 972 vulnerabilities, 112 of them critical, including two exploited zero-days. Researchers attribute the surge to AI-assisted bug discovery, with Microsoft already p…
Node.js version 24.21.0 has been released under the long-term support line codenamed Krypton. The update is available for download from the official Node.js distribution page. Teams running production workloads on the 24…
Anthropic bought Bun because Claude Code ships on it, and the deal will probably make Bun better. Kai argues the real lesson sits elsewhere: single-vendor runtime ownership is becoming normal, and the PHP world's messy, …
CVE-2026-85046, a V8 type confusion bug exploited in the wild, is being filed under 'browser news'. Wrong drawer. If your PHP app renders PDFs with Browsershot, runs Dusk or Panther in CI, or scrapes with Puppeteer, you …
An editorial by Kai · Sep 6, 2026
JOBS · Software engineering jobs Live facets from Job.bo — click opens the matching search
CVE-2026-85046, a type confusion bug in Chrome's V8 engine, is being exploited in the wild via a single crafted HTML page. Google patched it in Chrome 152.0.7977.82 on September 3, 2026; CISA added it to its Known Exploi…
Zod 4.5 introduces z.compile(schema), letting developers precompile validation schemas ahead of time to cut parsing overhead. The runtime validation library also slashes memory use, with a simple z.string() schema now co…
Attackers hijacked a /24 prefix hosting Softaculous update servers by exploiting lax RPKI settings at Hetzner Online and a forged AS path. Because Virtualizor update clients did not verify packages cryptographically, div…
The pnpm package manager ships version 12 as a complete Rust rewrite. Turborepo benchmarks on Linux show 64 to 90 percent faster installs. The release drops SSH access for GitHub, GitLab and BitBucket and adds support fo…
An opinion piece argues the Hugging Face security incident reflects a deeper flaw: operating systems and file systems were built to run programs, not protect application data. The author revives the decades-old 'thick-da…
A maintainer nearly merged a dependency-bump PR that quietly edited his CI config to raid a self-hosted runner holding cloud credentials. Kai argues the pipeline belongs in your threat model: fork PRs are remote code exe…
A developer traces a recurring PostgreSQL bug: an index on customer_id existed but Postgres ran a sequential scan anyway because the query also sorted by created_at. A composite index cut runtime from four seconds to nin…
Zod v4.5 introduces schema compilation promising 3 to 9 times faster validation. The maintainer of zod-compiler responded with benchmarks showing his tool still outperforms Zod's native z.compile() by a median of 1.75x, …
The htmx project has published version 4.0.0, announced on its four.htmx.org site on August 28, 2026. htmx is a small JavaScript library that lets developers add AJAX requests, WebSockets and other dynamic page behavior …
Vercel has patched two critical vulnerabilities in Next.js with its August security release. One flaw in the libheif library enables heap buffer overflows during AVIF image optimization (CVSS 9.8), the other (CVE-2026-75…
A newly published paper on mold, the massively parallel linker, is drawing discussion on r/programming. Its ablation study finds that speed gains do not come from any single optimization, but from running every linking p…
Node.js 24.20.0 'Krypton' (LTS), released 2026-08-26 by Antoine du Hamel, adds using scopes to AsyncLocalStorage, a buffer end parameter, permission.drop, a --permission-audit flag, package maps in the loader, a node:str…
Kubernetes v1.37 ships today with SELinuxMount on by default. If your nodes run SELinux enforcing and two differently-labeled pods share a PVC, one of them stops starting. I think you should upgrade into that break rathe…
The Node.js project has published version 26.8.0 of its JavaScript runtime. The release is part of the current 26.x line and is available for download from the official Node.js distribution channels. Details on included …
Go 1.27 ships generic methods, a rebuilt JSON engine under the old API, stdlib UUIDs and post-quantum crypto, and Go folks are asking if their minimalist language just blinked. Kai argues PHP resolved this debate long ag…
GitHub's August 17 outage lasted seven hours and 47 minutes and hit authentication, repositories, pull requests and Copilot. CTO Vlad Fedorov's postmortem blames a traffic spike: monthly commits doubled since April to 2.…
A supply chain attack on a Rust crate has reignited debate about dependency culture. A widely discussed Reddit post argues that Rust shares the npm mindset of pulling in many small packages, and that languages with large…
Microsoft has published TypeScript 7.0.2, a patch release in the new 7.x major version line. The tag was originally created in the typescript-go repository and points to the TypeScript 7.0 announcement for details on the…
Bun 1.4 completes the runtime's rewrite from Zig to Rust, adds 1,517 newly passing Node.js test-suite tests, and cuts idle CPU usage by a factor of five. New built-ins include Bun.Image, Bun.WebView, Bun.cron and a nativ…
Attack attempts against CVE-2026-19478, a critical GitLab vulnerability patched in an out-of-band release on Monday, have been observed by security firm watchTowr. The flaw lets unauthenticated attackers delete projects …
GitLab has patched two vulnerabilities, one rated critical, that allow attackers to manipulate or delete public projects and user data via the GraphQL API. Fixed versions are 18.11.11, 19.0.8, 19.1.6 and 19.2.4. Self-hos…
A community piece previews the next major version of DuckDB, the in-process analytical database popular with data engineers. Worth a read for anyone running DuckDB in production or evaluating it, since a major version bu…
PostgreSQL's team released versions 14.24, 15.19, 16.15, 17.11 and 18.6, fixing 28 vulnerabilities. Most let attackers run arbitrary code after a successful attack and gain full control of instances. Two high-severity CV…
Buf has released LSP support for Protocol Buffers, bringing IDE features like completion, navigation and diagnostics to .proto files. The announcement, discussed on r/programming, also drew comments on Buf's pricing: 36 …
