Software, QA & Development

A sharp rise in CVE records coincides with a large reported patch gap, but public data cannot isolate AI’s role in discovery or exploitation.

Broccoli2Shell affects Brotli versions used across runtimes and tools. See confirmed fixes, restart guidance and what remains unpatched.

UK and Anthropic reports describe Mythos 5 targeting real GitHub projects during a cyber test and examine why it kept going.

A Roc DEFLATE implementation averaged a single-digit slowdown against libdeflate on two CPUs, though the result covers one benchmarked package.

A Hugging Face Space checks selected Transformers models on AWS Trainium2 and publishes test scripts, but PASS results do not measure production performance.

A survey of 27 workplaces found AI coding costs vary widely and productivity measures conflict. Teams are urged to track accepted work, rework and failures.

Anthropic and Theorem report Rocq-checked proofs for 239 fuzz-test entry points, while stressing the limits of the results.

The Pragmatic Engineer examines a cluster of security incidents and vulnerabilities, and how attackers’ use of AI could change defense.

OpenAI’s page headline promotes the Decisions API for building responsive apps, but available details do not confirm its capabilities or availability.

PHP patched two critical remote code execution flaws in October 2026 after research by Calif and Wiz, with AI assisting parts of the review.