Tech radar: week 25 of 2026
15–21 Jun 2026
In the week of 15–21 Jun 2026, 16 notable open-source releases shipped (including FastAPI 0.138.0, Node.js v26.3.1, LangChain langchain-core==1.4.8), CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “A backdoor in a LinkedIn job offer” (1614 points).
Releases worth knowing about
Web frameworks
✨ Add support for app.frontend("/", directory="dist") and router.frontend("/", directory="dist"). PR 15800 by @tiangolo.
| Commit | Description |mentions security
See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.mdv800
[13.x] Fix incorrect casing of StdClass in SupportHelpersTest by @Soean in https://github.com/laravel/framework/pull/60479
Languages & runtimes
This is a security release.mentions security
AI & machine learning
Changes since langchain-core==1.4.7mentions security
helpers: tag refusal-fallback middleware requests with fallback-refusal-middleware (96) (2f8ac78)
api: update OpenAPI spec or Stainless config (2254235)
Two API surfaces now emit DeprecationWarning ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated A
vLLM v0.23.0 Release Notesmentions security
Mobile & desktop
<summary<em<h4Cargo Audit</h4</em</summarymentions security
Fixed a browser process crash when calling webContents.reload() or navigating synchronously from the render-process-gone event; the event is now emitt
Automation
1.123.57 (2026-06-17)mentions security
Cloud & DevOps
https://code.visualstudio.com/updates/v1125
This release fixes multiple security issues.mentions security
Testing & security tools
New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create(mentions security
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 4.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | 2026-06-15 |
| CVE-2026-54420 | LiteSpeed cPanel Plugin | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | 2026-06-15 |
| CVE-2026-20253 | Splunk Enterprise | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | 2026-06-18 |
| CVE-2026-48907 | Widget Factory Joomla Content Editor | Widget Factory Joomla Content Editor Improper Access Control Vulnerability | 2026-06-16 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01A backdoor in a LinkedIn job offer1614 points · 304 comments · 2026-06-15
- 02Running local models is good now1596 points · 608 comments · 2026-06-16
- 03Iroh 1.01398 points · 462 comments · 2026-06-15
- 04Midjourney Medical1377 points · 878 comments · 2026-06-18
- 05Ask HN: Has anyone replaced Claude/GPT with a local model for daily coding?1318 points · 563 comments · 2026-06-15
- 06Lore – Open source version control system designed for scalability1276 points · 680 comments · 2026-06-17
- 07SpaceX to buy Cursor for $60B1151 points · 1703 comments · 2026-06-16
- 08Sixty percent of US consumers say 'AI' in brand messaging is a turnoff1084 points · 577 comments · 2026-06-17
- 09TinyWind: A pixel pirate sailing game with real wind physics (380k+ kms sailed)1038 points · 192 comments · 2026-06-15
- 10GrapheneOS has been ported to Android 171021 points · 621 comments · 2026-06-16
- 11I found 10k GitHub repositories distributing Trojan malware987 points · 248 comments · 2026-06-18
- 12Hyundai buys Boston Dynamics975 points · 402 comments · 2026-06-19
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.