TL;DR NVIDIA released a software update for NemoClaw and OpenShell. It fixes 20 vulnerabilities, including two critical flaws scored CVSS 9.9. The worst, CVE-2026-65093, allows a sandbox escape leading to code execution. Update from the official GitHub repos now. Why These NVIDIA Vulnerabilities Matter NemoClaw and OpenShell support NVIDIA's AI tooling on Linux. Many teams run them close to sensitive models and data.

Release: llm-gemini 0.33 It's been a while since the last llm-gemini release. This version of the plugin adds support for today's Gemini 3.7 Flash release, plus gemini-3.6-flash, gemini-3.5-flash-lite and two embedding models gemini-embedding-2 and gemini-embedding-001. The plugin is also upgraded for compatibility with LLM 0.32, which means you can now see reasoning traces and you can also enable server-side tools using this pattern: llm -m gemini-3.7-flash -T CodeExecution \ 'use pyt

Release: llm-gemini 0.33 It's been a while since the last llm-gemini release. This version of the plugin adds support for today's Gemini 3.7 Flash release, plus gemini-3.6-flash, gemini-3.5-flash-lite and two embedding models gemini-embedding-2 and gemini-embedding-001. The plugin is also upgraded for compatibility with LLM 0.32, which means you can now see reasoning traces and you can also enable server-side tools using this pattern: llm -m gemini-3.7-flash -T CodeExecution \ 'use pyt

Release: llm-anthropic 0.26 Includes new features enabled by LLM 0.32: New models: claude-fable-5, claude-sonnet-5, and claude-opus-5. #75, #76 Added server-side tools for WebSearch, WebFetch, CodeExecution, and AnthropicMCP, available through LLM's -T interface or Python tools=. The previous -o web_search* options have been removed in favor of -T WebSearch. #79 Upgraded to llm>=0.32. Reasoning, tool calls, tool results, and server-side tool results now stream as typed events. Reasonin

TL;DR NVIDIA patched a critical NVIDIA BlueField vulnerability tracked as CVE-2026-65094. The VIRTIO-Net flaw scores a CVSS of 9.0. A virtual machine user could trigger code execution in the affected component. Why it matters NVIDIA BlueField DPUs offload networking for cloud and data center hosts. Therefore they sit in a trusted spot between VMs and hardware. A flaw here can break the isolation that cloud tenants rely on.

TL;DR A flaw in WordPress Coding Standards lets malicious PHP run code on the machine that lints it. Tracked as CVE-2026-45293, the bug carries a CVSS score of 8.6. The advisory calls it "an arbitrary code execution vulnerability" in one of the tool's sniffs. Why it matters WordPress Coding Standards is a hugely popular developer tool. It has passed 49 million installs on…

Rockwell Automation's code execution vulnerabilities in Arena Simulation software raise concerns about exploitation risks and user safety in operational

#NotebookLM is being renamed to #GeminiNotebook and will now offer more features across the Google ecosystem, including integration with the #Gemini app and #GoogleSearch. A new update provides a #securecloud computer for notebooks, enabling #codeexecution and #complexdataanalysis. https://blog.google/innovation-and-ai/products/gemini-notebook/notebooklm-gemini-notebook/?eicker.news #tech #media #news

TL;DR F5 has patched three memory safety flaws in NGINX Plus and NGINX Open Source. The most severe, CVE-2026-42533, is an NGINX code execution vulnerability in the map directive. It scores 9.2 (Critical) on CVSS v4.0, and fixed releases are available now. Why It Matters NGINX sits in front of a large share of the world's web traffic. All three flaws live in the data plane, so unauthenticated attackers can reach them with crafted HTTP requests.

Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to execute. Whatever that binary does, it does as you, with your source, your SSH keys and your cloud tokens. Cursor keeps re-running it for as long as the project stays open. No prompt

A critical security flaw in Claude Code GitHub Action allowed attackers to compromise entire repositories by creating a specially designed issue. The attack vector leveraged excessive permissions in automated workflows.

For as long as I have been coding in Java, we have had requirements to measure the execution time of blocks of code.

wild is not mentioned by Fortinet read more about Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution

each step is completed with no validation read more about Docker Fixes Critical Ask Gordon AI Flaw Allowing Code Execution via Image Metadata

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity security flaw impacting Gogs by adding it to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2025-8110 (CVSS score: 8.7), relates to a case of path traversal in the repository file editor that could result in code execution. "Gogs Path