P.01CVE-2026-88062: OmniRoute's Unauthenticated RCE
A single unauthenticated request can run code inside OmniRoute, the 58k-star AI gateway. Patch status is contested, so verify your build yourself.
Tag
37 articles tagged #Open Source.
P.01A single unauthenticated request can run code inside OmniRoute, the 58k-star AI gateway. Patch status is contested, so verify your build yourself.
P.02Abliteration.ai sells API access to open-weight AI models with safety refusals surgically removed, and the buyer inherits every future flaw.
P.03CVE-2026-49869 lets unauthenticated attackers hit any Kestra path ending in /configs, skip login, then run shell commands as root via script plugins.
P.04NVIDIA is acquiring Hugging Face for $12.93B. Here's what actually changes for the Hub, Transformers, and Inference Endpoints, and what to do before the 2027 close.
P.05A flaw in Gitea's diffpatch API turns a crafted merge conflict into an executable Git hook. CISA added it after miner payloads showed up. What to patch.
P.06Z.ai shipped GLM-5.3 on the same 743B base as 5.2, with every gain coming from reinforcement learning on top. What changed, what it costs, why it matters.
P.07Merged PRs on GitHub grew 3.6x since 2023. June's per-user cap for accounts without write access answers the AI slop flood. What it fixes, and what it doesn't.
P.08Meta's Muse Glimmer is an Apache 2.0 model for local agent tasks that fits a single 24GB consumer GPU and beats larger rivals on tool use. What it's for.
P.09GitHub restricted stargazers and watchers to admins and collaborators in July 2026. It stopped spam scraping, and took Star History and OSS Insight with it.
P.10Shieldstral is a 3B open-weight model that judges text and images against safety policies written in plain language at inference time, with no retraining.
P.11Qwen3.8-Max launched August 3 with 2.4 trillion parameters, a 1M-token context, and a promise to open the weights within a week. What actually changes.
P.12Two CVSS 10.0 zero-days in Joomla page builder plugins are being exploited to plant webshells and create rogue admins. What's affected, and what to patch.
P.13Ollama closed a $65M Series B on July 9, taking total funding to $88M with nearly 9M developers. What the raise signals for local versus hosted inference.
P.14Moonshot's Kimi K3 is the largest open-weight model yet and already leads closed frontier models on several benchmarks. What it costs, and when it matters.
P.15Together AI raised $800M at an $8.3B valuation with bookings past $1.15B. What the numbers say about running open weights versus closed APIs.
P.16Mistral confirmed a new open-weight MoE model in partner early access. No specs yet, but Studio and Forge, its sovereign AI play, are the real story.
P.17LongCat-2.0 is a 1.6T-parameter coding model Meituan trained on Chinese-made chips, ran anonymously on OpenRouter, then open-sourced under MIT.
P.18Curl killed its bug bounty in February and paused all HackerOne reports for July 2026, citing a flood of AI-generated slop. What that means for triage.
P.19MiniMax M3 is the first open-weight model to combine frontier-tier coding, a 1M-token context, and native multimodality. What it does, and how it benchmarks.
OpenFeature is a CNCF incubating project with broad SDK support. How to use vendor-neutral feature flags, and why the standard beats the tool behind it.
Bruno stores API collections as plain .bru text files in your git repo, no account or cloud sync needed. Here's how it compares to Postman and why teams switch.
If your design system needs to work in React, Vue, and a legacy jQuery app simultaneously, Web Components are the only native answer. Lit makes them practical to write.
Most agency developers never check the licence of an npm package until a client's lawyer does. What MIT, Apache 2.0, GPL and AGPL actually require.
HashiCorp's 2023 BSL relicensing split Terraform into OpenTofu, while Pulumi took a code-first approach. Here's how to choose between them in 2026.
In March 2024, Redis Ltd. relicensed Redis under a source-available license. Within weeks, the Linux Foundation forked it as Valkey. Two years on, here's how the split played out and what it means for teams choosing an in-memory data store today.
P.26Explore Hackbat, the open-source hardware platform launching in Q2 2026, set to redefine embedded security by offering full auditability and eliminating reliance on closed-source devices.
DeepSeek V4's Engram memory, mHC, and Sparse Attention combine to deliver million-token context at a fraction of the cost of Western frontier models.
P.28Nearly 200 developers urged Oracle to rethink MySQL's future. We break down the open letter, the governance crisis, the rise of PostgreSQL and alternatives, and what developers should do next.
Google Summer of Code 2026 accepted 185 organizations. Here is everything you need to know — eligibility, timeline, stipends up to $6,600, how to write a winning proposal, and the mistakes that get you rejected.
Open source powers the modern internet, but maintainer burnout and funding challenges threaten its future. Here's the state of open source sustainability and emerging solutions.
DeepSeek's V4 model brings 1 trillion parameters, Engram conditional memory, and open-source weights under Apache 2.0. We break down the architecture, coding benchmarks, geopolitical implications, and what it means for developers.
Moonshot AI's Kimi K2.5 is a 1-trillion-parameter open-source model with a 2M-token context window that nears GPT-5 performance. Here's how it was built.
A trademark dispute, crypto scammers, 100K GitHub stars, a social network for AI agents, and a security crisis — the Clawdbot saga has everything. Here's the full story of the viral AI assistant that broke the internet.
P.34DeepSeek and Qwen surged from 1% to 15% of the global AI market in a year, powered by 700M+ Hugging Face downloads and open-source models rivaling closed ones.
TII's Falcon-H1R 7B scores 88.1% on AIME-24 math, outperforming 15B models. Built on a hybrid Transformer-Mamba architecture, it signals a new era for efficient AI. Here's what it means for developers.
P.36EditorPickClawdbot turns WhatsApp, Telegram, and Discord into a self-hosted AI assistant with persistent memory. Here's the setup guide for macOS, Linux, and Windows.
P.37The AI industry is shifting from massive general-purpose models to smaller, specialized ones that outperform giants in specific tasks. Here's why this matters and how to take advantage of it.