Caldrel newshttps://caldrel.com/news/Short, sourced reports on tech, AI and security.enSat, 24 Oct 2026 09:00:00 +0800 OpenAI moves frontier model training offline after a model reached the internet through DNShttps://caldrel.com/news/openai-frontier-training-no-internet-access/https://caldrel.com/news/openai-frontier-training-no-internet-access/Sat, 24 Oct 2026 09:00:00 +0800AIOpenAI says it now trains frontier models with no live internet access, using a cached offline web, after a research model used a DNS resolver misconfiguration on 20 September to reach an external chatbot. Plex confirms four Media Server flaws are being actively exploitedhttps://caldrel.com/news/plex-media-server-actively-exploited-cves-cisa-kev/https://caldrel.com/news/plex-media-server-actively-exploited-cves-cisa-kev/Sat, 24 Oct 2026 09:00:00 +0800SecurityCISA added CVE-2026-96652, -96654, -96655 and -96656 to its KEV list on 20 October. Plex says chained together they allow remote code execution on servers older than 1.43.3.10861. Cursor adds Computer Use so its agents can operate desktop appshttps://caldrel.com/news/cursor-computer-use-desktop-apps/https://caldrel.com/news/cursor-computer-use-desktop-apps/Fri, 23 Oct 2026 09:00:00 +0800AICursor says its agents can now click and type across any app on a computer, not just the browser, including driving the iOS Simulator to test features they build. Moonshot AI releases Kimi K3.1 Pro, with open weights due by Nov 4https://caldrel.com/news/kimi-k3-1-pro-launch/https://caldrel.com/news/kimi-k3-1-pro-launch/Fri, 23 Oct 2026 09:00:00 +0800AIKimi K3.1 Pro and a faster Highspeed variant are available in Kimi's apps and API, with a 1-million-token context window. Full weights are due by 4 November. PHP discloses unpatched CVE-2026-115560 in session upload progresshttps://caldrel.com/news/php-cve-2026-115560-session-upload-progress/https://caldrel.com/news/php-cve-2026-115560-session-upload-progress/Fri, 23 Oct 2026 09:00:00 +0800SecurityTwo days after its 21 October security releases, PHP disclosed a separate, unpatched code execution path that it says needs an unusual setup and will be fixed in the next regular release. Malicious LiteLLM 1.107.0 release on PyPI and Docker carried a credential stealerhttps://caldrel.com/news/litellm-1-107-0-supply-chain-attack/https://caldrel.com/news/litellm-1-107-0-supply-chain-attack/Thu, 22 Oct 2026 09:00:00 +0800SecurityA poisoned LiteLLM release on PyPI and Docker carried a credential stealer and an hourly backdoor. Affected builds, how the malware worked and how the attacker got in. eMudhra to exit global SSL/TLS certificate businesshttps://caldrel.com/news/emudhra-exits-ssl-tls-certificates/https://caldrel.com/news/emudhra-exits-ssl-tls-certificates/Thu, 22 Oct 2026 09:00:00 +0800Dev & CloudAfter an incident with its certificate authorities, the Indian trust company says it will withdraw from public TLS certificates. Arista says VeloCloud Orchestrator flaw is being actively exploitedhttps://caldrel.com/news/arista-velocloud-orchestrator-cve-2026-114625/https://caldrel.com/news/arista-velocloud-orchestrator-cve-2026-114625/Thu, 22 Oct 2026 09:00:00 +0800SecurityCVE-2026-114625 (CVSS 9.9) in on-prem VeloCloud Orchestrator lets any authenticated user gain operator privileges. Fixes are in 5.2.3.18, 6.1.3.10 and 6.4.2.12. METR and Redwood red-team find gaps in OpenAI's internal agent monitoringhttps://caldrel.com/news/metr-red-teams-openai-agent-monitoring/https://caldrel.com/news/metr-red-teams-openai-agent-monitoring/Thu, 22 Oct 2026 09:00:00 +0800AIA three-week exercise found ways agents could postpone or avoid monitoring and bypass the Codex sandbox. OpenAI says the issues are patched; METR has not evaluated that claim. Quad9 to stop serving users in France on 24 November after court rulinghttps://caldrel.com/news/quad9-withdraws-from-france/https://caldrel.com/news/quad9-withdraws-from-france/Thu, 22 Oct 2026 09:00:00 +0800PolicyA French court ordered Quad9 to block domains in a case brought by beIN, with a €1,000 daily penalty. Quad9 says it will not block and will withdraw from France instead. Vercel sets deadlines for Marketplace vendors to drop long-lived credentialshttps://caldrel.com/news/vercel-phases-out-long-lived-credentials/https://caldrel.com/news/vercel-phases-out-long-lived-credentials/Thu, 22 Oct 2026 09:00:00 +0800Dev & CloudMarketplace vendors without OIDC support will get a "Not secure" label by 30 November 2026 and be delisted by January 2027. PHP security releases fix two remote code execution bugs after early leakhttps://caldrel.com/news/php-rce-security-release-october-2026/https://caldrel.com/news/php-rce-security-release-october-2026/Wed, 21 Oct 2026 09:00:00 +0800SecurityReleases across PHP 8.x fix two RCE flaws reported by Wiz Research. Details leaked before the release, and proof-of-concept code is now public. GitLab fixes CVSS 10.0 flaw affecting self-managed releases back to 7.0https://caldrel.com/news/gitlab-cve-2026-110264-cvss-10/https://caldrel.com/news/gitlab-cve-2026-110264-cvss-10/Wed, 21 Oct 2026 09:00:00 +0800SecurityCVE-2026-110264 could allow an unauthenticated attacker to run code on self-managed GitLab servers. Instances updated on 12 October are in range again. Railway says intruder may have accessed customer environment variableshttps://caldrel.com/news/railway-security-disclosure-environment-variables/https://caldrel.com/news/railway-security-disclosure-environment-variables/Wed, 21 Oct 2026 09:00:00 +0800SecurityRailway detected anomalous activity on systems storing customer environment variables, some of which may have been decrypted. Deployments are paused while it investigates. Chrome to remove eMudhra's emSign ECC Root CA - G3 on 27 Octoberhttps://caldrel.com/news/chrome-removes-emudhra-emsign-ecc-root/https://caldrel.com/news/chrome-removes-emudhra-emsign-ecc-root/Tue, 20 Oct 2026 09:00:00 +0800Dev & CloudGoogle says private keys for eight eMudhra intermediate CAs were generated with weak randomness. Chrome blocked them and will drop the root that signed them.