From InfoQ · 40 stories
Cloudflare moves to post-quantum cryptography with ML-KEM and ML-DSA
Cloudflare is transitioning its encryption methods to ML-KEM and ML-DSA to address quantum computing threats. The U.S. NIST standardized these algorithms in 2024, and Cloudflare aims for full post-quantum security by 2029.
Cloudflare Open-Sources AI Productivity Platform Cloudflare OS for Enterprise Use
Cloudflare has open-sourced Cloudflare OS, an internal AI productivity environment designed to help employees use AI safely and productively. The platform provides an agent chat UI, sandboxed application development, and a security framework called Gatekeepers, allowing other companies to adapt and customize the system for their own AI workloads and internal operations.
WhatsApp Rolls Out Optional On-Device Scam Alert Feature in Limited Beta
WhatsApp has launched a limited beta of "Scam Alert," an optional feature that uses an on-device machine learning model to identify suspicious messages from unknown contacts. This feature processes message content locally on the user's device to maintain end-to-end encryption while alerting users to potential scams. Users can block, report, or ignore flagged messages, and can opt to share message data to improve the model's accuracy.
AI Demand Drives PC Component Price Surge, Reversing Decades of Declines
Prices for PC components like RAM, SSDs, and hard drives have increased significantly over the past year, with some memory prices returning to 2007 levels. This surge is attributed to high demand from AI infrastructure buildouts, impacting PC builders and leading some manufacturers to shift focus to enterprise AI solutions.
Cloudflare to Launch Public Certificate Authority Supporting Post-Quantum Cryptography
Cloudflare announced its intent to become a public Certificate Authority (CA) and has applied for inclusion in major root programs, including Chrome, Apple, Microsoft, and Mozilla. This initiative includes plans to be among the first CAs to issue post-quantum certificates, specifically Merkle Tree Certificates (MTCs), targeting early 2027 for inclusion in Chrome's Quantum-resistant Root Store. The move aims to address the performance challenges of post-quantum cryptography at internet scale and expand Cloudflare's role in web encryption.
Cloudflare remediates cross-tenant data exposure vulnerability in Containers
Cloudflare fixed a vulnerability in its Containers and Sandboxes services that could have exposed residual disk blocks from other tenants. A security researcher reported the issue, which allowed Workers Paid account users to potentially recover data from previously used storage blocks on the same host. Cloudflare found no evidence of malicious exploitation and applied a fix across its Container fleet.
Symlink Vulnerability in AI Coding Assistants Poses Security Threat
Researchers discovered that a vulnerability in six AI coding assistants allows malicious repositories to execute code on developers' machines. By exploiting symbolic link (symlink) flaws, attackers could bypass user consent and access sensitive files, raising significant security concerns.
AWS Billing Bug Leads to Erroneous Billion-Dollar Estimates for Customers
AWS users experienced incorrect billing estimates due to a bug causing charges to show as billions of dollars instead of reflecting actual usage. The fault in the AWS billing computation system involved incorrect unit pricing. Amazon is addressing the issue by halting billing updates and reverting to accurate data.
Yelp Adopts Hybrid UI for AI Assistant, Combining Native and Server-Driven Rendering
Yelp implemented a hybrid user interface architecture for its AI Assistant, integrating native mobile controls with server-driven conversation rendering. This approach, utilizing Yelp's CHAOS framework, allows for faster interface updates across iOS, Android, and web platforms without requiring new app releases.
GitLab 19.5 Integrates External AI Agents and Introduces AI Governance Features
GitLab 19.5, released on October 15, makes its GitLab MCP server generally available, allowing external AI agents like Claude Code and Cursor to interact with GitLab's tools and Duo Agent Platform. The update also adds governance controls, providing security teams visibility into external agent usage and enabling recording of agent sessions for auditing.
TypeScript 7.1 Beta Restores Compiler API, Adds Vue and Svelte First-Class Support
Microsoft released TypeScript 7.1 Beta, which restores the compiler API dropped in version 7.0 by splitting it into focused entry points. This update also introduces content mappers, allowing TypeScript to process non-standard files like .vue and .svelte components with proper error mapping, significantly improving type-checking performance for frameworks like Vue.
TypeScript Compiler, Checker, and LSP Ported to Rust Using LLMs
A new project, tsc-rs, has successfully ported the TypeScript compiler, checker, and language server protocol (LSP) to Rust. This port was achieved using large language models (LLMs), specifically Claude Opus 5.5, and aims to provide a faster TypeScript type checker with high performance, including in WebAssembly environments.
AWS Lambda introduces Web Functions for standard HTTP web applications
AWS Lambda launched Web Functions, a new form factor enabling direct deployment of standard HTTP web applications without code rewriting. This allows developers to run port-listening servers from frameworks like Express or Next.js on Lambda, simplifying deployment and scaling for web applications and API backends.
Developer Releases Open-Source Adobe Creative Suite Alternatives Built with AI
Developer Brandon Thomas (u/ai_art_is_art) released seven open-source applications under the Artcraft brand, designed to replicate Adobe Creative Suite products like Photoshop and Premiere. These applications, including PhotoCraft and FilmCraft, were developed in Rust with WebAssembly versions, using Anthropic's Claude Opus 5.5 for AI-powered reverse engineering. The initiative aims to offer free alternatives with familiar interfaces, though initial versions face skepticism regarding functionality and code safety.
GitLab Duo Self-Hosted Integrates Microsoft Foundry for AI Model Deployment
GitLab Duo Self-Hosted now supports AI models deployed through Microsoft Foundry, allowing organizations to run GitLab's AI development features using models hosted within their own Azure environment. This integration provides enterprises with more control over model providers, deployment locations, and data paths, addressing data residency and regulatory requirements.
Cloudflare prototypes Zstandard compression in Pingora to save petabytes of cache storage
Cloudflare prototyped a Cache Transcoding system using Zstandard compression within its Pingora proxy, reducing cached asset sizes by two-thirds on average. This system aims to expand effective cache capacity and decrease cross-data center bandwidth usage by trading a minor CPU increase for significant storage savings.
AWS confirms permanent data loss in UAE data center after drone strikes, advises migration
Amazon Web Services (AWS) has confirmed the permanent loss of customer data in its mec1-az2 Availability Zone in the United Arab Emirates, six months after drone strikes impacted its data centers in Abu Dhabi and Bahrain. AWS is advising customers to migrate their applications to alternate regions as it cannot restore access to the affected zone and has not provided a full service restoration timeline, impacting regional cloud operations.
Shopify Reverts Mobile Development Strategy from React Native to Native Platforms
Shopify is transitioning its mobile application development from React Native back to native Swift and Kotlin. This shift is driven by advancements in large language models (LLMs), which have reduced the cost and effort associated with building features separately for iOS and Android.
Cloudflare Introduces Tools for an "Agentic Internet" to Support AI Agents
Cloudflare has launched a suite of new tools and concepts, including Cloudflare Wallets, Kitesurf, WebMCP integration, Cloudflare Computer, and Precursor, to establish an "Agentic Internet." This initiative aims to provide AI agents with stable identities, native payment methods, specialized browsing capabilities, efficient runtimes, and enhanced security for interacting with web content and APIs.
Microsoft Releases TypeScript 7.0 with Native Go Compiler, Delivering Significant Build Speedups
Microsoft has released TypeScript 7.0, which includes a new native compiler written in Go, resulting in build times that are typically 8 to 12 times faster. This update significantly improves developer productivity by reducing compilation and type-checking durations for large codebases.
Critical FFmpeg Vulnerability "PixelSmash" Allows Remote Code Execution via Crafted Video Files
JFrog Security Research disclosed "PixelSmash," a critical vulnerability (CVE-2026-8461) in the FFmpeg media framework that allows remote code execution (RCE) and denial of service (DoS) attacks. This flaw, present for sixteen years, enables attackers to execute arbitrary code or crash applications by delivering a specially crafted media file, impacting a wide range of desktop, server-side, and embedded systems that use FFmpeg.
Apple Revamps iOS 27 for iPhone Duo Foldable, Adds Apple Pencil Support
Apple has redesigned iOS 27 for its new foldable iPhone Duo, adapting controls and app layouts for the device's multiple screens and flexible display. The iPhone Duo will also be the first iPhone to support Apple Pencil, with USB-C Pencil support expected later this year.
GitHub Actions Lockfiles Reach General Availability to Secure Workflow Dependencies
GitHub Actions lockfiles are now generally available, allowing workflows to pin direct and transitive dependencies to specific commit SHAs. This feature addresses a security weakness where mutable references like tags or branch names could be altered, potentially introducing malicious code into pipelines. The lockfiles ensure that the runner executes the exact commits recorded, enhancing supply chain security for GitHub Actions workflows.
OpenBao 2.7 Adds External Key Support, PostgreSQL Read Scaling, and Post-Quantum TLS
OpenBao, a fork of HashiCorp Vault, released version 2.7, introducing read scaling for PostgreSQL backends, support for external HSM and KMS keys, and post-quantum cryptographic algorithms. This update expands OpenBao's capabilities, offering features previously restricted to enterprise licenses in Vault under an open-source license.
Edera Launches Object Capability Bounded Authority to Isolate AI Agent Credentials
Edera introduced Object Capability Bounded Authority, a security model designed to isolate autonomous AI workloads and Model Context Protocol (MCP) servers from sensitive credentials. This technology enforces granular object capabilities at the hypervisor level, preventing AI agents from directly accessing API tokens, cloud keys, and administrative credentials, thereby mitigating risks from prompt injection and supply chain attacks.
Amazon ECS Gateway Simplifies Ingress Networking for Containerized Services
Amazon introduced ECS Gateway, a new account-level resource that automates the provisioning and management of ingress networking infrastructure for containerized workloads on Amazon ECS. This solution reduces configuration overhead for platform teams and allows application teams to connect services without manual networking setup, optimizing infrastructure costs by enabling multiple services to share ALBs.
AliExpress uses hidden Web Audio API for fingerprinting, disrupting Bluetooth multipoint audio
AliExpress website scripts create hidden Web Audio API contexts that interfere with Bluetooth multipoint audio connections, even when no audible media is playing. This behavior is attributed to Alibaba's anti-abuse tooling, which uses the Web Audio API for browser fingerprinting.
OpenBSD 8.0 Released, Adds Intel Arc Support and Expanded Virtual Address Space
OpenBSD 8.0 has been released, marking the project's 61st semiannual update. This version introduces Intel Arc A-Series graphics card support and expands the AMD64 kernel virtual address space to 512GB, improving compatibility and VRAM mapping capabilities.
OpenAI Donates Open Responses LLM API Specification to Agentic AI Foundation
OpenAI donated its Open Responses API specification to the Agentic AI Foundation (AAIF), a Linux Foundation project. This specification aims to standardize core API calls for large language models across different providers, reducing the need for developers to adapt to vendor-specific APIs.
Google Cloud Data Agent Kit is now Generally Available, adding BigQuery Graph, Bigtable, and Apache Spark support
Google Cloud's Data Agent Kit is now generally available, providing tools and agent skills for coding agents to interact with Google Cloud data products. This release adds support for BigQuery Graph, Bigtable, and Managed Service for Apache Spark, allowing agents to inspect schemas, run queries, and manage resources directly within the user's data environment.
Cloudflare Unifies Observability Platform with Traces and Expanded Features
Cloudflare introduced eight updates to its observability platform, including the open beta launch of Cloudflare Traces. This update unifies logs, traces, analytics, alerts, and dashboards into a single system, providing end-to-end request tracing across the entire Cloudflare platform and offering a single pricing model for ingested and stored observability data. The changes aim to simplify troubleshooting and provide a comprehensive view of traffic processing.
Microsoft introduces dotnetup, a .NET toolchain manager for macOS and Linux
Microsoft has released a public preview of dotnetup, a new toolchain manager for .NET SDKs and runtimes on macOS and Linux. This tool aims to simplify installation, management, and updates by operating within user accounts, avoiding system-level permissions and conflicts.
.NET 11 Release Candidate 2 is Available with Go-Live Support
.NET 11 Release Candidate 2 is now available, offering go-live support for production applications. This release introduces updates across libraries, runtime, SDK, F#, ASP.NET Core, .NET MAUI, and Windows Forms, and is supported in Visual Studio 2026 Insiders and Visual Studio Code with C# Dev Kit.
Netflix Observability Team Discusses Ontology-Driven Knowledge Graph for E2E Monitoring
Netflix's observability team presented on building an ontology-driven end-to-end knowledge graph to manage observability at their scale. This approach addresses the data engineering challenges of monitoring 65 million concurrent streams, 2 billion daily requests, and 38 million logging events per second. The knowledge graph aims to provide insights into user experience from application click to content playback.
Microsoft to Deploy Maia AI Accelerators for Multi-Gigawatt Inference by 2027
Microsoft announced plans to scale its Azure Maia family of AI accelerators to multi-gigawatt deployments starting in 2027, making Maia the primary inference system for Microsoft products and services. Maia 200 is already in production, and the upcoming Maia 300 is designed for long-context, memory-intensive inference workloads, featuring a custom AI transport built on Ethernet.
Cloudflare-acquired VoidZero releases Vite+ 1.0 with GitLab CI support and tsup migration
VoidZero, acquired by Cloudflare, released Vite+ 1.0, the stable version of its unified JavaScript toolchain, which integrates Node.js, a package manager, and a frontend stack. This release adds GitLab CI/CD support, improved migration for tsup projects, and new diagnostic and Git hook commands, simplifying JavaScript development workflows.
Cloudflare launches K2 in public beta, a serverless event streaming service
Cloudflare introduced K2, a new serverless event streaming primitive now available in public beta on its Developer Platform. K2 provides durable, ordered event logs built on R2 object storage, decoupling data producers and consumers to prevent event loss and scale independently.
Cloudflare launches OHTTP Gateway for privacy-preserving HTTP requests
Cloudflare announced the Cloudflare OHTTP Gateway, a new paid add-on that allows customers to receive HTTP requests without exposing user IP addresses. This expands Cloudflare's existing OHTTP product suite, which previously included only an OHTTP relay, providing a complete solution for developers to integrate privacy into their applications.
Cloudflare Open Sources Clef Decision Models for AI Agents
Cloudflare released Clef, a set of open-weight AI models (9B and 27B parameters) designed for decision-making rather than text generation. These models process various data types to return probabilistic choices, offering an alternative to traditional LLMs for specific AI agent tasks.
Cloudflare Introduces Application Profiles and Tests WAF Against AI-Generated Attacks
Cloudflare launched Application Profiles, a new feature designed to enforce positive security policies by analyzing HTTP request structures and identifying deviations, thereby reducing the attack surface area for web applications. Concurrently, Cloudflare tested its Web Application Firewall (WAF) against attack payloads generated by frontier AI models, leading to the development of new detection rules to improve WAF efficacy against evolving threats.