Latest security news

PHP 8.6.0 RC3 available for testing

The PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC3. This continues the PHP 8.6 release cycle, whose rough outline is specified in the . PHP Wiki Source downloads of PHP 8.6.0 RC3 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NE…

Building a Public Performance Change Detection Library for MariaDB

Performance engineering inside a database project is usually private. Teams run internal workloads, investigate changes, fix issues, and move on. The knowledge stays inside the company, and the outside world only sees a benchmark graph or a release note. I know this pattern well — I spent more than twenty‑six years doing this work for […] Building a Public Performance Change Detection Library for MariaDB appeared first on MariaDB.org

Django security reporting update

We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies . Security issues should be reported by emailing security@djangoproject.com

Open Source milestone – MariaDB’sEcosystem hub hits 200 solutions

New ‘App store of open source’ is one stop shop serving the fast-growing MariaDB community’s needs for applications, developer tools, cloud platforms and projects. The MariaDB Foundation today announces the MariaDB Server Ecosystem Hub has exceeded 200 entries, just six months after launch. The Hub is a curated, open directory of MariaDB Server approved products, […] Open Source milestone – MariaDB’sEcosystem hub hits 200 solutions appeared first on MariaDB.org

Node.js 26.11.1 (Current)

Node.js 26.11.0 (Current)

Start Your Next KMP App With Kotlin Toolchain 0.13

The Kotlin Toolchain is a unified entry point into Kotlin. It lets you build JVM, Android, iOS, multiplatform, and server-side applications with a simple declarative configuration. With the release of v0.13, we now recommend the Kotlin Toolchain for most new Kotlin Multiplatform (KMP) projects. Earlier this year, we promoted the Kotlin Toolchain to Alpha. Since […]

Laravel 13 now supports MariaDB Vector natively

If your Laravel application runs on MariaDB, you can add semantic search to it without a second database, an external vector service or an extra package. Since Laravel 13.28, vector columns, vector indexes and similarity queries work on MariaDB out of the box. A large part of that work came from community contributors, including Mohamed […] Laravel 13 now supports MariaDB Vector natively appeared first on MariaDB.org

VirtusLab assumes responsibility for Scala 2 maintenance

We are happy to announce that VirtusLab has assumed responsibility for maintenance of Scala 2 . This means that VirtusLab, in coordination with the Scala Center and the Scala Core Team, now manages the development of both Scala 2 and Scala 3. Former members of the Scala 2 team at Akka have joined the VirtusLab OSS team, so there will be no impact on Scala 2 maintenance or Scala 2’s future. Our plans for Scala 2 maintenance have long been documented at https://www.scala-lang.org/development/#scala-2-maintenance and the wordings there have not changed. VirtusLab will maintain Scala 2.12 and 2.1…

runc v1.6.0-rc.1 -- "Lo bueno, si breve, dos veces bueno."

This is the first release candidate of the upcoming runc 1.6.0 release. It contains a couple of new features, but is mostly made up of various cleanups (such as the removal of many deprecated APIs) and improvements. This version includes all of the patches backported to runc v1.5.2. Users are strongly encouraged to test our release candidates so we can fix issues before the general release. libcontainer API configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a *unix.CPUSet , and the Initial / Final fields of configs.CPUAffinity and the Nodes field of configs.LinuxMemoryPolicy have ch…

Next.js 16.4

Next.js 16.4 introduces lazy compilation, smaller Turbopack output, React 19.3 features, Cache Components improvements, and new developer tooling.

The Shift to cgroup v2 in Kubernetes: What You Need to Know

In Linux, cgroups (control groups) are a kernel feature used for managing system resources. Kubernetes uses cgroups to allocate resources like CPU and memory to containers, ensuring that applications run smoothly without interfering with each other. With the release of Kubernetes v1.31, support for v1 cgroup management moved into maintenance mode . Support for v2 cgroup management has been stable since Kubernetes v1.25. Compared with cgroup v1, cgroup v2 provides a single unified hierarchy, a more consistent interface, and a stronger foundation for resource isolation and modern resource-manag…

A faster, lighter C# Dev Kit

C# Dev Kit has been rebuilt to open solutions in about a second and run on a fraction of the memory, and this post walks through what changed for you. The post A faster, lighter C# Dev Kit appeared first on .NET Blog .

WordPress 7.1.3 Maintenance and Security Release

This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background […]

Django security releases issued: 6.1.2, 6.0.9, and 5.2.18

In accordance with our security release policy , the Django team is issuing releases for Django 6.1.2 , Django 6.0.9 , and Django 5.2.18 . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very long language codes. Language codes were used as keys in an in-memory cache before their length…

Preparing for Post Quantum DNSSEC with PowerDNS

Today’s widely used DNSSEC signatures rely on mathematics that a sufficiently capable quantum computer could break. The timing of that capability remains uncertain, but changing

Let's meet in October

Scala Days 2026 is just around the corner! Next week, on 12 and 13 October , the Scala community will come together at Kulturbrauerei in Berlin for two days of learning, sharing experiences, and catching up with friends and colleagues. The program opens with a keynote by Martin Odersky. There will also be interactive labs, giving you time to explore tools and ideas with their maintainers. Whether you use Scala every day or are getting to know the ecosystem, we look forward to welcoming you. If you’d like to stay a little longer, two-day workshops follow on 14 and 15 October at Hotel Oderberge…

Scaling Kubernetes Workloads with Node Swap

Memory is often the first hard limit a Kubernetes cluster hits. Nodes run out of RAM long before they run out of CPU, and the new wave of agentic AI workloads makes this worse. These workloads demand large memory footprints to start up and run untrusted code, then sit idle waiting for the next prompt. That idle but resident memory is expensive, and it caps how many pods a node can hold. This is where swap helps. Kubernetes support for running nodes with swap enabled reached General Availability in v1.34, and by backing that swap with fast NVMe solid state drives (SSDs), a node can page out do…

UWP and WinUI 3 apps: UI testing with MSTest

Learn how to test UWP and WinUI 3 apps with MSTest and Microsoft.Testing.Platform across packaged, unpackaged, and AppContainer hosts. The post UWP and WinUI 3 apps: UI testing with MSTest appeared first on .NET Blog .

Discontinuing Swift Language IDE Support in the Kotlin Multiplatform Plugin

Starting with IntelliJ IDEA 2026.3 and Android Studio Rabbit 2 | 2026.2.2, we’re discontinuing Swift language IDE features in the Kotlin Multiplatform (KMP) plugin. This includes editing, syntax highlighting, and navigation within Swift files and between Swift and Kotlin. Running iOS applications and debugging Kotlin code on iOS will remain fully supported. Kotlin/Native functionality, such […]

Laravel September product updates

Laravel Cloud added isolated preview environments and request metrics. The framework added per-tenant AI keys and semantic search. See what's new in September.

Arch-specific SIMD in Go

Go 1.27 introduces experimental arch-specific SIMD vector APIs

Demoting i686 Windows targets to std-only

With Rust 1.100.0, the following changes to 32-bit Windows targets will happen: i686-pc-windows-msvc Tier 1 with host tools target will be demoted to Tier 1 without host tools. i686-pc-windows-gnu Tier 2 with host tools target will be demoted to Tier 2 without host tools. Builds of the standard library will continue to be distributed, but host tools such as the compiler will be no longer available. i686-pc-windows-msvc as a Tier 1 target still undergoes CI testing. To build 32-bit Windows binaries, cross-compiling from a still-supported host toolchain (such as a 64-bit Windows ones) will be r…

Rails World recordings are online, new minimum Ruby version and more!

Hi, it’s Greg. Let’s explore this week’s changes in the Rails codebase.

Python 3.15.0 candidate 3 is here!

Following tradition, a surprise rc3!

Nominate Someone for the 2026 Malcolm Tredinnick Memorial Prize

Hello Everyone 👋 It is that time of year again when we recognize someone from our community in memory of our friend Malcolm. Malcolm was an early core contributor to Django and had a huge influence on the Django we know today. Besides being knowledgeable, he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day. The prize Our prizes page summarizes it nicely: The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Mal…

PowerDNS Recursor 5.3.11 and 5.4.7 Released

Today we have released PowerDNS Recursor 5.3.11 and 5.4.7. These are maintenance releases that fix bugs and include a few improvements. The most important ones are:

Announcing Rust 1.99.0

The Rust team is happy to announce a new version of Rust, 1.99.0. Rust is a programming language empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup , you can get 1.99.0 with: $ rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.99.0 . If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel ( rustup default beta ) or the nightly channel ( rustup default nigh…

Rails World 2026 recap: All talks online

Happy to report that in record time, all Rails World 2026 talks are now online.

Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available!

Security updates across Python 3.10–3.14, the final maintenance release of 3.13, and a farewell to Python 3.10.

September 2026 Security Release

The September 2026 security release for Next.js is now available

Migrating Pinkary from Laravel Forge to Laravel Cloud: An engineering playbook

Pinkary's move from Laravel Forge to Laravel Cloud exposed SQLite and MySQL differences, query assumptions, and local-storage coupling. Here is the code-backed migration playbook.

Python Language Summit 2026

The 2026 Python Language Summit was hosted in Kraków, Poland as part of EuroPython 2026. There were 15 talks covering free-threading, Rust, garbage collection, type annotations, and more.

Lightning Talks (Python Language Summit 2026)

Lightning talks on a one-time ABI break, safer interruptions, EktuPy (Scratch but Python), an AGENTS.md file for CPython, and a call to read PEP 836.

PEP 827: Type Manipulation (Python Language Summit 2026)

Michael J. Sullivan presents PEP 827 and discusses a key design decision: how to store type annotations?

Free-Threaded Python Post-Era (Python Language Summit 2026)

Tobias Wrigstad, Fridtjof Stoldt, and Donghee Na propose a safe and performant, high-level concurrency model for free-threaded Python

Developer-in-Residence Update & Future (Python Language Summit 2026)

Petr Viktorin gives an update on the Developer-in-Residence role and asks Python core developers for projects to prioritize

Spicycrab (Python Language Summit 2026)

Kushal Das shows off Spicycrab, a Python-to-Rust transpiler for Python users who need performance without learning Rust or leaving Python

Rust for CPython (Python Language Summit 2026)

David Hewitt shares a status update, first module, and potential acceptance criteria for the Rust for CPython project

Memory Snapshots for CPython (Python Language Summit 2026)

Hood Chatham proposes memory snapshots and an initialization phase for speedier Python startups

Memory Buffer Protocol (Python Language Summit 2026)

Nathan Goldbaum proposes safe concurrent access through buffer leases and custom data types for the Python Buffer Protocol.

Garbage Collection: Generational? Incremental? Both! (Python Language Summit 2026)

Mark Shannon proposes a future garbage collection strategy for Python following the revert of the incremental garbage collector in Python 3.14

macOS and Python (Python Language Summit 2026)

Ned Deily weighs whether Python should continue shipping macOS installers

One namespace to namespace them all (Python Language Summit 2026)

Pablo Galindo Salgado proposes a top-level `std` namespace for the Python standard library to prevent module shadowing and free up module names.

The Companions to Come

We are working on extensions to our companions mechanism to unlock new code patterns and improve interoperability across different platforms. This post outlines these new features and provides preliminary guidance on migration. Companion blocks and extensions Many programming languages provide a notion of class or type members – functionality that does not belong to each […]

End of Life Announcement: Debian 11

On the 31st of August of this year (2026) Debian 11 "Bullseye" reached the end of its Long Term Support period, at which point we consider Bullseye to be End of Life. As we do not want to support our software running in unpatched environments, we have stopped building for Debian Bullseye. After the 1st of January 2027, we will start removing all repositories for this unsupported distribution from https://repo.powerdns.com/ . Users are recommended to upgrade their systems to supported operating system versions, such as Debian 12 or 13, or RHEL 9, 10, or any of the popular derivatives of RHEL.

The State of Kotlin in 2026 Report

In 2026, Kotlin turned fifteen. Over those fifteen years, Kotlin has built a mature ecosystem, been adopted by companies around the world, and established a large and active developer community. Fifteen years is long enough to understand which technology trends lasted and which didn’t. This report looks back at Kotlin’s first fifteen years to see […]

Build Agentic UI with the new Blazor AI components

Build Agentic UI with the new Blazor AI components for streamed content, tools, approvals, shared state, and generative experiences. The post Build Agentic UI with the new Blazor AI components appeared first on .NET Blog .

Preview environments and scale to zero: Better together

Give every pull request its own preview environment on Laravel Cloud. Share a link, test the full stack, and let idle previews scale to zero.