Google Gemini 3.5 Transcribe Debuts & AWS Glue 5.1 Arrives & Critical Gitea RCE Exploited

Google's Gemini 3.5 Transcribe brings intelligent speech-to-text with real-time accuracy, AWS Glue 5.1 upgrades data integration engines, and critical Gitea CVE-2026-60004 sees active exploitation with malware payloads.

AI & ML

Google launches Gemini 3.5 Transcribe, a speech-to-text model that converts raw audio to polished, formatted text with intelligent disfluency cleanup, function calling for complex tasks, and real-time capabilities. Available via Gemini API, Google AI Studio, and Enterprise Agent Platform. Read more
OpenAI expands ChatGPT for Teachers to 100,000+ educators with new data privacy agreements spanning 16 states and a shared implementation model providing training and support. Tool remains free for verified U.S. K-12 educators through June 2028. Read more

AI Coding Tools

AI coding assistants ship security vulnerabilities at scale, with syntax-correct code masking poor security practices. Salt released Salt Code to embed enterprise security policies directly into Cursor and Claude installations, preventing vulnerable patterns from reaching production. Read more
Kimi Work brings local AI agent to desktop with native file access, task automation via Cron engine, web browsing, and unified workflows—reducing repetitive work and query latency while keeping data local. Read more

Frameworks & Libraries

Next.js 16 introduces Cache Components for improved performance and developer experience. Requires Next.js 16, with automatic detection of runtime data access errors directing developers to proper patterns for force-static routes. Read more
Next.js View Transitions API now enabled by default in App Router, supporting morphing elements, shared animations, and route-based transitions using React 19's ViewTransition component—works in Chromium 125+, Safari, and Firefox. Read more
Next.js deploymentId config prevents version skew during rolling deployments by maintaining consistent build identifiers across containers, triggering hard navigation on client mismatch. Read more

Languages & Runtimes

Go 1.27 ships generic methods for concrete types, allowing type parameters directly on methods without receiver restrictions—addressing long-standing community requests for cleaner, more ergonomic code. Read more

Browser & Web Platform

Safari Technology Preview 251 adds major CSS and layout features including @supports at-rule(), random() functions, @container queries, white-space-trim, View Timeline improvements, and Navigation API fixes for better DOM reconciliation and scroll handling. Read more

DevOps & Cloud

AWS Glue 5.1 upgrades core engines to Apache Spark 3.5.6, Python 3.11, Scala 2.12.18, and adds support for Apache Iceberg format v3.0 with default column values, deletion vectors, and row lineage tracking. Lake Formation now extends fine-grained access control to write operations for Spark DataFrames and SQL. Read more
Amazon MSK enables in-place ZooKeeper-to-KRaft cluster upgrades without downtime, eliminating Apache ZooKeeper dependency and requiring Kafka client v3.0+ with bootstrap.servers connections only. Read more
DuckDB integrated into AWS services for analytics acceleration: Amazon Quick reduced average query latency by 30% using DuckDB optimizations; Allen Institute processes terabytes of scientific data with sub-second queries. DuckDB now supported in Lambda functions. Read more
Cloudflare WAF detects HTTP/2 Request Smuggling and JavaScript event handler coercion attacks with new XSS detection rules deployed in log mode. Read more

Databases & Data

ClickHouse .NET Driver 1.3 adds nested array support with both jagged (T[][]) and rectangular (T[,]) CLR array shapes for write operations; reads default to jagged but GetFieldValue materializes rectangular directly. Read more
MongoDB Atlas joins Google Cloud Foundation Fabric FAST with pre-configured provisioning, Private Service Connect security, real-time BigQuery analytics via Datastream, and Vector Search for agentic AI memory. Read more
PlanetScale Model Context Protocol server exposes read/write SQL queries, query performance insights, and billing management as tools for AI agents, with RLS warnings and safeguards against accidental data loss. Read more

CMS & Site Builders

Contentful emphasizes structured content architecture for AI to enable personalization at scale through modular components, metadata filtering, and dynamic assembly—avoiding manually maintained page copies that drift. Read more
Wix explains how to sell from AI-generated websites via Wix Headless backend combining stores, bookings, CMS, and payments in one platform—no per-feature charges or API fees. Read more

Security

Critical Gitea RCE CVE-2026-60004 (CVSS 9.8) actively exploited with miner-like payloads; unauthenticated attackers can register, create repos, and execute arbitrary shell commands via diffpatch API. CISA added to Known Exploited Vulnerabilities catalog; patch to v1.27.1 or later. Read more
Critical Avada WordPress theme RCE chain CVE-2026-18431 (CVSS 9.8) enables zero-click arbitrary PHP execution via six chained vulnerabilities requiring Avada ≤7.16 and Fusion Builder ≤3.16. Affects 1M+ installations but requires both plugins active. Read more
Ubiquiti patches three maximum-severity vulnerabilities: CVE-2026-77537 (UniFi Protect improper input validation), CVE-2026-77550 (CRLF injection authentication bypass), CVE-2026-77554 (UniFi Talk command injection). Fixed in Protect 7.2.105+, Talk 5.3.2+, OS 5.1.21+. Read more
Kaltura mwEmbed HTML5 player contains unpatched RCE vulnerabilities CVE-2026-19912 and CVE-2026-19913 via unsafe deserialization in mwEmbedLoader.php, allowing unauthenticated file read and code execution. Affects Kaltura Server and html5lib distributions. Read more
CISA adds six Known Exploited Vulnerabilities including CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer overflow), CVE-2022-0995 (Linux kernel OOB write), CVE-2019-1068 (SQL Server RCE), and older flaws now weaponized by threat actors. Read more
Chrome 152.0.7977.65 patches use-after-free in extensions (CVE-2026-79026, CVSS 9.6) allowing remote code execution outside sandbox via crafted extensions leveraging social engineering. Read more

Dev Tools & IDEs

Zed 1.17.1 preview available for macOS 10.15+, Windows, and Linux—latest bleeding-edge release with high update frequency and potential for bugs. Read more