Let's Encrypt says it will issue 64-day certificates by default from February 10, 2027, shortening authorization reuse to 10 days; 45-day certificates follow in 2028.
StepSecurity says two hijacked maintainer accounts, including Uber athenadriver's author, pushed a credential-stealing workflow to 345 repositories on October 8; Socket counts 500+ accounts.
GitHub's October 7 changelog says a fine-tuned model now powers AI-detected Password alerts at no extra charge, while push protection and security-review checks will consume AI Credits.
Claude Code 2.1.295 adds an opt-in setting that blocks an action when a command or HTTP hook fails; 2.1.294 and 2.1.296 fix hook-enforcement bugs, per release notes.
Astral's Ruff 0.17.0 release notes, dated October 9, list code-signed executables, a default Python version of 3.11, changed default rules and the removal of ruff-lsp support.
OpenAI's Decisions API, in beta since October 6, returns probabilities, choices and scores from gpt-6-luna; OpenAI lists input at $0.10 per 1M tokens.
Researchers say a lone operator published 12 npm packages since August 2023, eight malicious; Checkmarx found three still installable on September 29 with incomplete advisory coverage.
System76's COSMIC desktop now requires contributors to declare no AI-generated content in pull requests, while GNOME's Michael Catanzaro argues projects should still accept AI-generated vulnerability reports.
The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.
Hugging Face Transformers v5.19.0 adds EmbeddingGemma 2, a Gemma 4-based embedding model for text, images, audio and video, and flags breaking changes.
Astro 7.3.8 and companion packages replace direct esbuild use with Vite's Oxc transform and Rolldown, while create-astro stops writing pnpm install-script approvals.
NATS Server v2.15.1 and v2.14.8, both published October 9, remove legacy $GR. reply-prefix support and fix JetStream, leafnode, MQTT and permission-refresh bugs.