DevHunt Daily
Dev tools & AI news, every day
Thursday, October 22, 2026
- 1SecurityHacker News
PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixing critical RCE bugs
The PHP Foundation announced new patch releases for PHP 8.5, 8.4, 8.3 and 8.2 that address two critical remote code execution vulnerabilities. Developers are urged to update immediately to mitigate unauthenticated code execution risks. The post also outlines recent security process changes and the new Ecosystem Security Team.
- 2SecurityHacker News
LiteLLM 1.107.0 on PyPI contained a credential stealer and backdoor
The 1.107.0 release of the LiteLLM Python package was found to install malicious files that steal SSH keys, cloud credentials and other secrets, and run a remote code execution daemon. The malicious code was removed from PyPI after discovery, highlighting the risk of compromised packages for developers.
- 3AIHacker News
Mistral launches public preview of 1‑trillion‑parameter Mistral Large 4 model
Mistral released a public preview of its new Mistral Large 4 model, a 1 trillion‑parameter multimodal system with 52 billion active parameters. The model shows strong results in coding, cybersecurity, finance and legal tasks and will have open weights released by the end of the month, allowing self‑deployment.
- 4AIHacker News
Claude Duet launches as proactive AI assistant for task management
Claude Duet is an AI agent that monitors tasks, provides morning briefs, and handles actions like scheduling and data retrieval, requiring user approval for sensitive steps. It integrates with over 6,000 connectors, including Stripe, Shopify, Slack and Notion, and is available on Pro and Max plans in the US.
- 5Open sourceHacker News
DuckDB releases 2.0.0 LTS with Quack protocol and async I/O
DuckDB 2.0.0 LTS, codenamed “Cinnamon Teal”, adds a polished Quack client‑server protocol, asynchronous I/O, a VARIANT type, agent mode, triggers and an extensible SQL parser. The release also introduces a CONNECT statement for remote databases and CLI flags for serving and connecting.
- 6SecurityHacker News
OpenAI shares PHP version checker as Codex skill after AI‑found vulnerabilities
OpenAI coordinated a response to critical PHP flaws discovered with GPT‑5.6, working with maintainers and partners to release fixes. It provided a PHP version checker as an OpenAI Codex skill to help operators identify vulnerable installations. Developers using PHP should apply the patches and can use the checker to verify their versions.
- 7AIHacker News
OpenAI models and Codex added to Google Cloud Model Garden
OpenAI announced that its frontier models and Codex will be available through Google Cloud's Model Garden and Marketplace. Developers can access these models natively on GCP with built‑in access controls and data governance, enabling enterprise‑scale agentic workflows.
- 8WebVercel
Vercel adds Python support for routing middleware
Vercel now lets developers write routing middleware in Python for frameworks like FastAPI, Flask, and Django. The middleware runs before the main app and can rewrite, redirect, or respond to requests, configured via the vercel.toml proxy entrypoint.
vercel.com - 9SecurityCloudflare
Cloudflare WAF adds full transaction detection and response rules
Cloudflare's WAF can now evaluate HTTP requests together with their responses, enabling detection of exploits that only become evident after the origin replies. It also introduces response rules that can block malicious responses before they reach the client, and the features are available to all customers, including free plans.
blog.cloudflare.com - 10LanguagesCloudflare
Cloudflare releases tsrs, a Rust port of the TypeScript compiler
Cloudflare and VoidZero announced tsrs, a Rust implementation of the TypeScript compiler that runs up to eight times faster and uses about 70% less memory than the standard TypeScript 7.0. The project aims to speed up type checking and enable more efficient development environments, including in browsers via WebAssembly.
blog.cloudflare.com - 11Dev toolsGitHub Changelog
GitHub CLI adds optional expiring, auto‑refreshing OAuth tokens
GitHub CLI v2.103.0 introduces a preview feature that lets users opt in to expiring access tokens with automatic refresh. By using the --expiring flag or a config setting, the CLI handles token renewal, reducing the risk of long‑lived leaked tokens. Developers using gh for authentication or git operations can benefit from improved security.
github.blog - 12SecurityGitHub Changelog
Dependabot alerts API now returns dependency version information
The Dependabot alerts REST API now includes a version_requirement field showing the vulnerable dependency version or constraint. This eliminates the need to parse lockfiles or make extra GraphQL calls when syncing alerts to security tools. The field is available on GitHub.com, Enterprise Cloud, and Enterprise Server 3.24.
github.blog - 13WebVercel
Vercel Functions adds general availability for WebSocket support
WebSocket support in Vercel Functions is now generally available after a public beta. The platform has handled 300 million connections and now serves 15 million per day, enabling AI chat, streaming, and real‑time multiplayer apps. Pricing follows standard Function limits with active CPU billing for message processing.
vercel.com
Built something developers should hear about? Launch it on DevHunt: the week’s top launches make the news here.