Tech radar: week 41 of 2026
5–11 Oct 2026
In the week of 5–11 Oct 2026, 14 notable open-source releases shipped (including OpenAI Python SDK v3.29.0, Tauri tauri v2.12.3, Expo [email protected]), CISA added 5 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “Margaret Hamilton has died” (2123 points).
Releases worth knowing about
AI & machine learning
api: add billingnotactive session error code (4052) (c88b320)
api: add types for the Chat and Cowork unified analytics metrics
<img width="2716" height="2308" alt="image" src="https://github.com/user-attachments/assets/84734e74-163d-4d12-b166-ffcf6749d563" /
This release features 717 commits from 307 contributors (96 new)!mentions security
Mobile & desktop
<summary<em<h4Cargo Audit</h4</em</summarymentions security
- [iOS] Add getAppleStoreEnvironmentAsync(), which returns StoreKit's App Store environment for the running build ('production', 'sandbox' or 'xcode')
The macOS autoUpdater now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a
Web frameworks
Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL environment variables, set FASTAPIOTELAU
Check out the 16.4 announcement post to get an overview of the changes.mentions security
[13.x] Allow fake assertions to accept an array of properties by @jackbayliss in https://github.com/laravel/framework/pull/61770
Cloud & DevOps
- 16036 9a58244 Thanks @edevil! - Support temporary event accounts in R2 and Containers commands
https://code.visualstudio.com/updates/v1141
Languages & runtimes
\[2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
Testing & security tools
New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 5.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2016-3081 | Apache Struts | Apache Struts Command Injection Vulnerability | 2026-10-08 |
| CVE-2015-5477 | ISC BIND | ISC BIND Data Processing Errors Vulnerability | 2026-10-08 |
| CVE-2021-3199 | ONLYOFFICE Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability | 2026-10-08 |
| CVE-2015-3306 | ProFTPD ProFTPD | ProFTPD Improper Access Control Vulnerability | 2026-10-08 |
| CVE-2023-22894 | Strapi Strapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | 2026-10-08 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01Margaret Hamilton has died2123 points · 258 comments · 2026-10-07
- 02Mistral Large 42042 points · 1216 comments · 2026-10-06
- 03Triple-A Minesweeper1444 points · 287 comments · 2026-10-09
- 04Cloudflare acquires Deno1387 points · 726 comments · 2026-10-09
- 05Sharing AI progress in mathematics1362 points · 1540 comments · 2026-10-06
- 06Why isn't the industry freaking out about DeepSeek 4.1 Flash?1136 points · 989 comments · 2026-10-08
- 07Passkeys are a trap1136 points · 575 comments · 2026-10-11
- 08Sorry, I'm in a meeting1050 points · 288 comments · 2026-10-09
- 09Claude Haiku 5.51049 points · 488 comments · 2026-10-07
- 10Whistle: Speech to Text in 16.9 MB962 points · 185 comments · 2026-10-08
- 11Man discovers his parents' coffee machine used 1TB of data in 10 days960 points · 575 comments · 2026-10-07
- 12I hired an illustrator to draw my house. Now it's my Home Assistant dashboard937 points · 209 comments · 2026-10-07
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.