News
What changed, what it means and what to do about it.
- News Work software
Nextcloud Collabora flaw joins CISA list; 29 and older get no fix
Attackers use a flaw in Nextcloud's built-in Collabora server to plant web shells. Nextcloud 29 and older have no patched build: upgrade or remove the app.
- News Developer tools
Brotli flaw spreads past Node.js to Python, Envoy, Istio and Bun
CVE-2026-111497 sits in Google's Brotli decoder, so any service that unpacks Brotli data needs a patched build, not only Node.js apps.
- News AI
OpenAI Decisions API leaves beta with no charge for output
Classifiers and routers can get typed answers from gpt-6-luna for $0.10 per million input tokens. The saving is the output fee; the bigger change is speed.
- News Work software
Arc browser stops working December 22; export keeps only links
Arc data deletion starts after December 22. Dia imports passwords and history; Arc's own export saves only a list of tab links.
- News Developer tools
eMudhra quits TLS after key flaw; old trust stores still at risk
Browsers already block eMudhra's eight broken CAs. Servers, scripts, containers and macOS command-line tools may still trust them until you update.
- News Developer tools
GitLab CVSS 10 flaw hits every release since 7.0; patch again
A login-free code execution flaw hits self-managed GitLab servers on every release since 7.0. Older 19.x and 18.11 lines got fixes too.
- News Developer tools
PHP fixes are out: 8.5.12, 8.4.27, 8.3.36 and 8.2.35
PHP's two critical flaws hit every PHP web server, and only the update closes them. Ubuntu packages carry the fix under different version numbers.
- News Developer tools
PHP patches two critical bugs today; 8.1 and older get no fix
PHP ships fixes for two remote code execution flaws at 14:00 UTC. Sites on PHP 8.2 or newer can patch; older ones need a host's backport or an upgrade.
- News AI
Gemini small-business hub: which account keeps receipts private
Google's new Gemini tools read receipts and Xero books. On a personal account, people may review chats; on Workspace, they stay in house.
- News Developer tools
Google Cloud London outage: one-zone power event hit 38 products
A power event in one London zone disrupted Revolut for hours, and Google reported errors beyond that zone. What that means for multi-zone setups.
- News AI
Cloudflare's Clairic reads invoices for $0.10 per million tokens
A preview model returns invoice fields with confidence scores, not generated text. The free tier covers about 1,680 small requests a day; PDFs need converting.
- News Developer tools
Cloudflare sends new projects to Workers; static sites stay free
Pages stays supported while feature work goes to Workers; static hosting stays free after a move, but only domains on Cloudflare's nameservers can follow.
