AI
OpenAI red-teaming uncovers critical remote code execution flaw in Brotli compression library
OpenAI disclosed that a red-teaming exercise turned up a serious security vulnerability in Brotli, a widely deployed open-source compression library bundled with major software including Node.js, Bun, and Envoy. The flaw enables unauthenticated remote code execution, meaning an attacker could run arbitrary code without any credentials on affected systems — a finding with broad implications given how deeply embedded Brotli is across the web infrastructure stack.
Replit acquires Chroma to give AI agents better memory and context
Replit CEO Amjad Masad announced the acquisition of Chroma and its founding team, calling the vector-database startup pioneers who were building retrieval-augmented generation infrastructure before the term entered mainstream AI discourse. Masad said the Chroma team will focus on one of the hardest unsolved problems in agentic AI: supplying agents with the persistent context and memory they need to complete real-world tasks reliably.
Consumer Tech & Gadgets
Apple iPhone Duo reviews land: impressive foldable but heavy, pricey, and software-limited
Early reviews of Apple's $1,999 iPhone Duo are coalescing around a consistent verdict: a polished, first-class foldable that delivers strong performance, battery life, and cameras, but asks buyers to overlook a heavy chassis, a premium price, software limitations, and an app ecosystem that has not yet caught up to the form factor. Engadget called it a first-class device while flagging the need for app optimization, and 9to5Mac argued that the phone's quirks do not diminish how impressive it ultimately is one day after launch.
For prospective buyers still on the fence, Engadget also weighed software limitations, camera compromises, available pre-sale deals, accessories, and rival foldable options before recommending whether to pull the trigger on a pre-order — a sign that the buying decision is far from straightforward despite the device's headline appeal.
Apple reportedly planning touchscreen MacBook Pro and OLED iPad Mini
The Verge is reporting on a cluster of upcoming Apple hardware moves, including a long-rumored touchscreen MacBook Pro and a new OLED iPad Mini, suggesting Apple is preparing a significant refresh across both its laptop and tablet lines in the near term.
Design
Procreate Pocket redesigned and optimised for the new iPhone Duo
Procreate has shipped a major update to Procreate Pocket, redesigning the app with a new look built specifically for the iPhone Duo's larger, dual-screen form factor while remaining optimised for standard iPhones. The update is available now via the App Store. Alongside the launch, designers have been sharing detailed UI motion studies of the Duo's system animations — including Touch ID unlock sequences, Airplane Mode transitions, and 5G/Wi-Fi indicator animations — highlighting how Apple's new hardware is already shaping interaction design conventions.
Figma Make adds Payload CMS backend and opens to all users
Figma has rolled out a significant expansion to Figma Make, integrating Payload CMS directly into the tool so designers can ship websites with a built-in backend without leaving Figma. The feature, which had been in limited access, is now available to all users as of today. The move positions Figma Make as a more complete design-to-production pipeline, blurring the line between design tooling and full web development environments.
Dev Tools & Infrastructure
Bun 1.4.4 patches three security vulnerabilities including HTTP/2 and HTTP/3 exploits
Bun published three security advisories covering flaws present in version 1.4.3 and earlier: a compromised eMudhra certificate issue, a brotli decoder bug dubbed HTTP2Shell, and an HTTP/3 "Header Accordions" timing attack. All three are fixed in Bun 1.4.4, and the team is urging developers to upgrade immediately and rebuild any artifacts produced with bun build.
Vercel ships terminal-based spend budgeting tool for teams
Vercel released a new CLI command, vercel budgets set, that lets teams configure on-demand spending caps directly from the terminal. When a team hits 100% of its budget, production deployments are automatically paused, and alerts can be routed to email or a webhook, with a full alert history available for review.
Gaming
Ocarina of Time confirmed for Nintendo Switch 2 on November 5
Nintendo of America confirmed that The Legend of Zelda: Ocarina of Time will arrive on Nintendo Switch 2 on November 5, marking the classic N64 title's debut on the new platform. The announcement came alongside a separate update that The Legend of Zelda: Echoes of Wisdom collectible card packs are now live in the Nintendo Today app, each featuring quiz questions to test player knowledge.
Until Dawn 2 character revealed ahead of January 2027 launch
PlayStation introduced Cameron, a scare technician for the in-universe Dead True horror experience, as a new character in Until Dawn 2. The reveal continues a drip of character introductions ahead of the sequel's confirmed launch date of January 28, 2027.
Security
Critical Brotli memory-corruption flaw affects Node.js, Bun, Python, Envoy, Istio and more
A memory-corruption vulnerability tracked as CVE-2026-111497 in the Brotli compression library, initially flagged under the Node2Shell RCE campaign, turns out to affect a far wider range of software than first reported. Bun, Python's Brotli packages, Envoy, and Istio are all confirmed vulnerable, dramatically expanding the attack surface for any organization running modern cloud-native or microservices infrastructure.
CISA adds Collabora Online and Arista VeloCloud flaws to exploited-vulnerabilities catalog; patch deadline October 26
CISA has confirmed active exploitation of two critical flaws and set a federal patch deadline of October 26. Attackers are abusing a Collabora Online vulnerability to plant web shells on Nextcloud servers, while a newly catalogued Arista VeloCloud flaw marks the third exploited VeloCloud vulnerability since July. CISA also updated its PHP2Shell alert with a new SIGMA detection rule and is urging organizations running unsupported PHP 8.1 or earlier to take affected systems offline immediately if patching is not possible.
The PHP2Shell advisory update adds partner-contributed resources alongside the SIGMA rule, reinforcing that threat actors are actively targeting PHP-based systems. CISA's guidance is explicit: if an immediate update is not feasible, take the affected system offline rather than leave it exposed.
LiteLLM supply chain attack traced to unrevoked GitHub master key leaked five months earlier
LiteLLM has disclosed the root cause of last month's supply chain attack: a master API key that leaked on GitHub in May was never revoked. Attackers used it to access the project's Agent Platform, escalate privileges by stealing a GitHub owner token, and ultimately publish a malicious release to PyPI in October. The incident is a stark example of how a single unrotated credential can sit dormant for months before enabling a full-chain compromise.
Startups & Funding
a16z data shows GPU rental rates far outpacing depreciation schedules, pointing to sustained AI infrastructure scarcity
New charts from a16z show GPU rental prices running well above standard six-year depreciation schedules across every major chip class: H200s rent at a 143% premium, B200s at 111%, RTX PRO 6000s at 73%, H100s at 54%, and A100s at 9%. The firm notes that most of the gap opened after April, when token demand accelerated sharply, directly rebutting the bear case that GPUs would depreciate quickly as a commodity. A16z partners Alex Danco and Moses Sternstein argue the rental data is evidence of genuine scarcity rather than temporary speculation.