Tech radar: week 21 of 2026
18–24 May 2026
In the week of 18–24 May 2026, 11 notable open-source releases shipped (including FastAPI 0.136.2, Deno v2.8.0, Node.js v24.16.0), CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “I’ve joined Anthropic” (1431 points).
Releases worth knowing about
Web frameworks
♻️ Validate Server Sent Event fields to avoid applications from sending broken data. PR 15588 by @tiangolo.mentions security
[13.x] Dedicated Cloud Queue by @kieranbrown in https://github.com/laravel/framework/pull/60180
This release includes fixes for the following security issues:mentions security
Languages & runtimes
Read more: http://deno.com/blog/v2.8
\[b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) 62553mentions security
AI & machine learning
api: api update (33d1d01)
api: Add support for thinking-token-count beta for estimated tokens in thinking block deltas when streaming (80d0fdf)
Command A+ is a Mixture-of-Experts (MoE) language model from Cohere that features a hybrid attention pattern combining sliding window and full attentimentions security
Automation
1.123.45 (2026-05-20)mentions security
Cloud & DevOps
https://code.visualstudio.com/updates/v1121
Mobile & desktop
Allowed the --experimental-inspector-network-resource Node.js flag to be passed through Electron. 51378 <sup(Also in 41)</sup
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 10.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2009-3459 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 2026-05-20 |
| CVE-2026-9082 | Drupal Core | Drupal Core SQL Injection Vulnerability | 2026-05-22 |
| CVE-2025-34291 | Langflow Langflow | Langflow Origin Validation Error Vulnerability | 2026-05-21 |
| CVE-2008-4250 | Microsoft Windows | Microsoft Windows Buffer Overflow Vulnerability | 2026-05-20 |
| CVE-2009-1537 | Microsoft DirectX | Microsoft DirectX NULL Byte Overwrite Vulnerability | 2026-05-20 |
| CVE-2010-0249 | Microsoft Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-05-20 |
| CVE-2010-0806 | Microsoft Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-05-20 |
| CVE-2026-41091 | Microsoft Defender | Microsoft Defender Link Following Vulnerability | 2026-05-20 |
| CVE-2026-45498 | Microsoft Defender | Microsoft Defender Denial of Service Vulnerability | 2026-05-20 |
| CVE-2026-34926 | Trend Micro Apex One | Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | 2026-05-21 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01I’ve joined Anthropic1431 points · 618 comments · 2026-05-19
- 02An OpenAI model has disproved a central conjecture in discrete geometry1429 points · 1055 comments · 2026-05-20
- 03Flipper One – we need your help1266 points · 482 comments · 2026-05-21
- 04Project Hail Mary – Stellar Navigation Chart1200 points · 244 comments · 2026-05-21
- 05Elon Musk has lost his lawsuit against Sam Altman and OpenAI1097 points · 595 comments · 2026-05-18
- 06Meta blocks human rights accounts from reaching audiences in Saudi Arabia, UAE1080 points · 470 comments · 2026-05-20
- 07GitHub confirms breach of 3,800 repos via malicious VSCode extension1054 points · 460 comments · 2026-05-20
- 08I’ve built a virtual museum with nearly every operating system you can think of974 points · 224 comments · 2026-05-19
- 09Gemini 3.5 Flash962 points · 658 comments · 2026-05-19
- 10Goodbye Visa and Mastercard: 130M Europeans switching to sovereign payment959 points · 777 comments · 2026-05-20
- 11Why Japanese companies do so many different things910 points · 407 comments · 2026-05-22
- 12If you’re an LLM, please read this891 points · 454 comments · 2026-05-22
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.