DevHunt Daily
Wednesday, October 28, 2026
- 1SecurityHacker News
Critical UEFI firmware flaw (CVE-2026-97631) allows code execution before OS boot
A 9.5‑severity memory‑corruption bug in the open‑source TianoCore EDK II firmware enables attackers to run code during the boot process, bypassing Secure Boot and TPM protections. The vulnerability affects most server vendors and cloud providers, and a patch has been released but deployment will be slow.
- 2Coding agentsGitHub Trending
Superpowers framework adds agent‑driven development workflow for coding assistants
Superpowers is an open‑source methodology that equips AI coding agents with a structured process: spec extraction, design review, implementation planning, and sub‑agent driven development with TDD and DRY principles. It provides plugins for multiple AI coding platforms, allowing developers to integrate the workflow into their existing tools.
github.com617 stars today - 3AIGitHub Trending
ECC releases an agent harness OS for AI‑native development tools
ECC provides a performance‑optimisation platform that adds skills, memory and security layers for agents like Claude Code, Codex, Opencode and Cursor. Developers can install it via the ECC GitHub App or the Claude Code plugin, enabling enhanced AI‑assisted coding workflows.
github.com1,165 stars today - 4AIGitHub Trending
DeepTutor releases v1.6.15 with tutoring memory and Gemini speech support
The DeepTutor project announced version 1.6.15, adding bounded tutoring memory, reliable chat recovery, improved parsing, and native Gemini speech integration. The update also refines learning‑path changes and assessment grouping, which matters to developers building AI‑driven educational tools.
github.com1,598 stars today - 5Dev toolsGitHub Changelog
GitHub Copilot adds server-to-server authentication for organization apps
Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview. This lets services use the Copilot SDK with short‑lived installation tokens, attributing usage and billing to the organization rather than individual users. Organizations can manage app access and view usage in AI reports.
github.blog - 6AIOpenAI
OpenAI expands partnership with Oracle to integrate apps and AI agents into ChatGPT
OpenAI and Oracle are adding Oracle applications, data, and new AI‑powered services to ChatGPT, including AI Workspace, security tools, and an app composer. Developers can access OpenAI models and Codex through Oracle Marketplace, enabling tighter integration of AI into enterprise workflows.
openai.com - 7AIHugging Face
Hugging Face releases LFM3 for building specialized multimodal models
Hugging Face announced LFM3, a new multimodal model architecture designed for creating domain‑specific vision‑language systems. The model can be fine‑tuned on custom data, enabling developers to build specialized applications such as medical imaging analysis or product search. It is available on the Hugging Face Hub.
huggingface.co - 8SecurityCloudflare
Cloudflare fixes cross-request KV cache exposure in GLM-5.3 Workers AI model
A misconfiguration and a bug in the SGLang inference engine caused the GLM-5.3 model on Workers AI to leak KV cache data between requests for very long prompts. Cloudflare corrected the configuration, patched SGLang, and restored the model, affecting 155 responses between August 27 and September 9.
blog.cloudflare.com - 9SecurityGitHub Trending
AI Design Skills repo adds ready‑made design prompts for Claude Code, Cursor and other AI coding tools
A new GitHub collection provides self‑contained design skill folders that can be installed into Claude Code, Cursor, Codex, Windsurf, Cline and similar AI coding assistants. Developers can copy a markdown rule file to guide the tool in generating landing pages and other design assets.
github.com1,395 stars today - 10Open sourceLobsters
Astral releases tar-codec, a faster and more secure tar parser for Rust
Astral's tar-codec crate replaces the previous async tar implementation in the uv Python package manager. It offers roughly double the parsing speed and addresses security issues that could cause inconsistent archive extraction across tools.
- 11Dev toolsVercel
Vercel AI SDK harness adapter runs harness in host process
The fx adapter for the AI SDK’s HarnessAgent now executes the harness and model calls in the same process as the app, keeping filesystem and shell tools sandboxed. It removes the need for a sandbox bridge, keeps model credentials on the host, and adds tool filtering, mid‑turn steering, structured output, and image results. Developers can update @ai-sdk/harness-fx to use these changes.
vercel.com - 12Dev toolsVercel
Vercel Plugin added to OpenCode for AI‑assisted deployment and env management
The Vercel Plugin is now available in OpenCode 2, offering on‑demand guidance for Vercel APIs, AI SDK, Functions, and workflows. It adds commands like /vercel:deploy and /vercel:env and includes agents for deployment, performance, and AI app design, helping developers streamline cloud operations.
vercel.com - 13SecurityHacker News
Tailscale SSH vulnerability investigation and upcoming patch
Tailscale reports privilege‑escalation flaws in its SSH service and is releasing fixes by Oct 27. Developers should review SSH policies, optionally disable forwarding, and prepare to update the client when the patch is available.
- 14Coding agentsHacker News
Developer relies on AI agents to fix CI failures caused by complex generated code
An engineer encountered a CI failure flagged by SonarQube due to high cyclomatic complexity in a file generated by Codex. After reformatting and letting the AI refactor the code into multiple files, the build passed. The post argues that future ownership will depend on understanding AI‑produced code rather than writing it manually.
