A quick roundup of developer news since the last digest.

Security

  • Critical RCE in Apache HTTP Server's HTTP/2 module: CVE-2026-119618 is a race condition in mod_http2 that lets a remote, unauthenticated attacker corrupt heap memory and potentially run code as the web server user. No public exploit or in-the-wild use was reported at disclosure; patch now, or turn off HTTP/2 until you can. Wiz
  • GitHub Actions now supports workflow lockfiles: Rather than hand-pinning every action to a commit SHA, you can run the gh actions-lock extension to generate .github/workflows/actions.lock, verify it in CI, and let Renovate or Dependabot keep it updated. Hugo van Kemenade's walkthrough covers the full setup. hugovk.dev
  • LLM 0.37.2 fixes an API key leak: Two bugs in Simon Willison's llm CLI could send your OpenAI key to a third-party OpenAI-compatible endpoint that was configured through extra-openai-models.yaml. If you use custom endpoints, upgrade. Simon Willison

AI & tooling

  • AWS releases an official local emulator: AWS Emulator runs local copies of AWS services, so you can run tests without a paid account. It is written in Rust, and a large swarm of AI agents built it, with nearly 30,000 commits in its first three weeks. AWS says the agents will also maintain it. GitHub
  • Google launches the Gemini Decisions API: The new Gemini Decision 1 model answers up to 1,000 yes/no, multiple-choice or rubric questions about one multimodal input in a single pass, returning probabilities instead of generated text. It targets routing, grading and policy checks at roughly 150-250 ms per call. Google
  • GitHub Agentic Workflows is generally available: You describe a task in Markdown and the tool compiles it into a standard Actions workflow that runs a coding agent in a sandbox with read-only access. Separate jobs apply any writes. Custom jobs and direct write permissions don't get these protections, so check your configuration carefully. InfoQ
  • Nvidia donates OpenShell to the CNCF: Nvidia has handed OpenShell, its open-source runtime for securing and governing AI agents, to the Cloud Native Computing Foundation, moving agent governance toward vendor-neutral stewardship. The New Stack
  • MCP may finally get proper file uploads: The Model Context Protocol has never had a clean way to pass files to tools, and developers have relied on workarounds for two years. A proposed extension aims to fix that. The New Stack
  • Apple tunes vector search for real query patterns: Apple researchers describe making maximum inner product search for RAG faster by optimizing for the queries a system actually receives, which are short questions that look very different from the long documents being searched. Apple Machine Learning Research

Languages

  • The C++26 draft fails its national body vote: For the first time, a draft C++ standard did not win ISO approval. It got 60% of participating members' support against a two-thirds requirement, and 12 countries abstained. The result points to deep disagreement over where the language should go. herecomesthemoon.net

Industry

  • Nvidia's board weighs Jensen Huang's future: After Huang admitted to an affair with a suspected Chinese intelligence asset, reports of a relationship with a senior Nvidia executive prompted urgent board talks. Shares fell about 8% after hours, and Nvidia has no published succession plan. Ars Technica
  • United Airlines bans AI agents from booking flights: United is blocking third-party personal AI assistants from making reservations, both directly and through agencies. It cites credential-sharing risks and federal rules that require travelers to vouch for their own baggage. Expect more companies to restrict agent access. CBS News
  • Indie games face a reckoning over AI-assisted code: Some Independent Games Festival jurors refuse to vote for any game made with generative AI. A well-known studio then disclosed limited LLM use to fix a stubborn Unity bug, which set off a broad debate about where the line sits. Ars Technica

This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.