vibehacker
News
GitLab Docs ·

GitLab ships another CVSS 10.0 patch for a regex-compiler RCE reaching back to version 7.0

Released Oct 21, GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9 and backports down to 18.11.13 fix CVE-2026-110264, an integer overflow when compiling a crafted regular expression that could let an unauthenticated attacker run code on the server. It follows the Oct 12 CI/CD regex fix (CVE-2026-97229); GitLab.com is already patched, so self-managed instances, including ones your agents or runners connect to, should upgrade now.

Read at docs.gitlab.com

More news

View all

LayerFS 1.0 gives every coding agent its own writable workspace over shared, branchable history

Released Oct 21 as MIT source, LayerFS mounts a full workspace per agent without copying the base, commits each step into one SQLite store, and lets agents branch, rewind, or merge, refusing same file clashes unless a .lww rule says the newest edit wins. For now it runs through the dsh layerfs plugin for DeepSeek Harness, and the README warns the store has no crash or power loss durability (docs)…

GitHub (Ephemeral-AI-Lab/layerfs)

Corridor's Argos, a fine-tuned 9B model, picks security guidance for coding agents before they write code

Released Oct 21, corridor argos 1 is a Qwen3.5 9B fine tune that reads a coding agent's plan and returns the project specific security requirements that apply, such as which auth middleware or upload helper to use, feeding Corridor's Agent Steering. On Corridor's own SecReT benchmark it scored 0.655 micro F1, the best of 14 models tested, with the lowest mean time to first token at 740 ms…

Corridor Research

DeepSeek open-sources DeepInfer, the inference engine behind its V4.1-Flash API

Released Oct 20 under Apache 2.0, DeepInfer runs DeepSeek V4.1 Flash on NVIDIA SM100 GPUs or Huawei Ascend 950 NPUs with DeepSeek's own kernels, expert parallelism, speculative decoding, deterministic sampling, and structured outputs. It's offline batch inference only for now: KV cache management, prefill/decode disaggregation, and load balancing stay internal (The New Stack)…

GitHub (deepseek-ai/DeepInfer)

Linux 7.4 docs add an AGENTS.md for coding agents and drop the Assisted-by tag requirement

Merged by Linus Torvalds on Oct 21, the docs 7.4 pull adds a top level AGENTS.md symlink to the kernel README so agents find the contribution rules, and removes the Assisted by: attribution requirement and its checkpatch handling, as agreed at the Maintainers Summit. AI agents still must not add Signed off by ; only the human submitter certifies the patch (pull request)…

Linux kernel (git.kernel.org)

Claude Code 2.1.307 adds /claude-api api-version to migrate code and stops double-sent MCP tool calls

The Oct 21 release adds /claude api api version to move your Claude API code to the new 2026 10 21 version, plus a claude code.safety event OpenTelemetry event for every tool call a permission rule, auto mode, hook, or sandbox blocked or prompted. It also stops HTTP MCP tool calls being sent twice when a connection drops mid call (only read only or idempotent tools retry now), and Code Review gains @claude review stop to end an always on PR subscription…

GitHub (anthropics/claude-code)

Spotted something we missed? Start a thread.