DevHunt Daily
Saturday, October 31, 2026
- 1AIHacker News
Claude Code VS Code extension on Cursor Marketplace contains SSH backdoor
Phorion discovered that versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension distributed via the Cursor Marketplace install a persistent SSH key and attempt to enable remote login on macOS, Linux and Windows. Developers should check for these versions and remove them to prevent unauthorized access.
- 2SecurityHacker News
Northflank reports major security incident and outage
Northflank disclosed a security breach affecting AI API keys and causing a major outage across multiple components. The company advises developers to assume all environment variables are compromised, rotate secrets, and disable public addon access. MongoDB secret rotation has been enabled for all users.
- 3SecurityHacker News
New Azure API Connections flaws enable cross-tenant compromise of backend services
A researcher disclosed additional vulnerabilities in Azure Logic Apps API Connections that allow attackers to hijack any connection and access linked services such as Key Vault, Azure SQL, Jira or Salesforce. The issue stems from insufficient input validation in the API Management layer, enabling path‑traversal and token reuse across tenants.
- 4SecurityHacker News
Linode reports security incident related to CVE-2026-98432
Linode disclosed a security incident involving CVE-2026-98432 and is deploying mitigations while investigating impact. Customers are advised to apply operating‑system updates promptly. No evidence of exploitation on the Akamai Compute platform has been found yet.
- 5SecurityHacker News
GitHub reports outage affecting Actions, Pages, and Webhooks
GitHub experienced degraded performance and delays in Actions workflows, Pages deployments, and webhook events on Oct 30, 2026. The issue was mitigated and services have recovered, though the root cause is still under investigation. Developers using these services may have faced build failures or delayed deployments.
- 6SecurityHacker News
ICE takedown notice rejected after ZeroFox‑driven request
A takedown demand from a company acting for ICE, using ZeroFox monitoring, was declined because the site published government employee work details, which the host deemed public‑interest journalism. The domain was temporarily taken offline by its registrar but later restored under a new name, highlighting challenges of automated takedown services.
- 7Dev toolsVercel
Vercel merges Data Cache into Runtime Cache for unified data caching
Vercel has integrated its Data Cache service into the Runtime Cache product, allowing developers to reuse fetched or computed data across requests without a separate caching layer. The change works with Next.js fetch caching, unstable_cache, and supports other frameworks like SvelteKit and Nuxt, with larger storage for Pro and Enterprise plans.
vercel.com - 8Dev toolsVercel
Vercel Daemons can now call services via service bindings
Vercel added support for daemons to bind to services in the same deployment. Developers declare a binding in vercel.toml, which provides the service URL as an environment variable for the daemon to call via standard HTTP. The routing, authentication and TLS are managed by Vercel, keeping services private.
vercel.com - 9CloudCloudflare
Cloudflare makes private origin services generally available
Cloudflare now lets customers point proxied DNS records to private IPs, routing traffic over Cloudflare One connections while applying WAF, caching, bot management and Workers. This extends Cloudflare’s security and performance features to internal APIs and services without exposing public IPs.
blog.cloudflare.com - 10AIOpenAI
OpenAI will honor shared robots.txt signal for AI training preferences
OpenAI announced it will respect a new common signal in robots.txt that lets website owners specify whether their content may be used for AI training. This simplifies the process for publishers by allowing a single rule to apply across multiple AI providers. Existing crawler controls remain unchanged.
openai.com - 11Open sourceGitHub Trending
Matt Pocock releases "skills" repo with ready‑to‑use AI agent plugins for Claude, Codex, Copilot and Gemini
The Skills repository provides small, composable prompt files that can be installed as plugins for Claude Code, Codex, GitHub Copilot and Gemini CLI. Developers can add the skills to their projects in seconds, then run a setup command to configure issue tracking, labeling and documentation generation, improving alignment with AI coding agents.
github.com876 stars today - 12AIGitHub Trending
Lightpanda releases a lightweight Zig‑based headless browser
Lightpanda Browser is a new headless browser written in Zig, claiming to use 16× less memory and run 9× faster than Chromium in benchmarks. It can be installed via Homebrew, AUR, Nix, Docker or direct binary downloads for Linux, macOS and WSL2. Developers can use it with existing automation tools like Puppeteer or Playwright via its CDP server.
github.com626 stars today
