The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 1 to 12 of 68 briefings

Today

An open dark grey laptop on a dark workbench shows a blank release notes page: a pale address pill, a header band, three indigo bars and an amber outlined panel with four equal rows, each with an empty amber circle, the top row also carrying one empty cyan capsule. A blurred network switch with coiled cables sits behind. The left half is empty dark blue with the headline OpenSSL 4.1.0 ships with four known DTLS bugs and the stat 1 OF 4.

Market and Supply Chain26 Oct 2026

OpenSSL 4.1.0 release notes list four known DTLS bugs and say a fix is in progress for one of them

What OpenSSL 4.1.0's Known issues say about its four DTLS bugs, what the tracker adds, five more open DTLS issues, who is exposed, the build options that were removed, the support window and a ranked checklist for maintainers and operators.

Yesterday

A dark desk with one monitor on the right showing five pale rows, two with a red badge, one with an amber badge and two with grey badges. The left half is empty dark blue and carries the headline, Next.js 16.4.1, two critical RCEs, one with no CVE id and no workaround, and the stat 8 days: Next.js advisory to GitHub's database.

Market and Supply Chain25 Oct 2026

Next.js 16.4.1 fixes two critical RCEs: one has no CVE id or workaround, GitHub's feed lagged 8 days

What Vercel, React, sharp, Red Hat and the registries print about the 14 October Next.js release: the timeline, the three scores for one library bug, the ids that exist, the sharp range gap on 15.5, the technical artifacts, and the UK clocks.

Saturday 24 October

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Market and Supply Chain24 Oct 2026

Brotli decoder flaw CVE-2026-111497: fixes in Node.js, Bun and the PyPI Brotli packages

Technical autopsy of Brotli CVE-2026-111497: Heap buffer overflow in decode.c exposes Node.js, Bun, and Python runtimes to remote code execution and denial of service via malformed compressed HTTP streams.

Editorial illustration of an AI data-centre rack beside the Kimi K3.1 Pro headline, noting API access now, weights later and $2 input/$10 output pricing per million tokens.

Market and Supply Chain24 Oct 2026

Kimi K3.1 Pro launches at $2/$10 per million tokens, weights promised by 4 November

Kimi K3.1 Pro is live by API at $2 input and $10 output per million tokens. We examine benchmark methods, real request costs, cyber capability and the promised open-weight release.

Friday 23 October

Market and Supply Chain23 Oct 2026

Pillow 13.0.0 fixes Ghostscript argument injection CVE-2026-112900; CVE record scores it 9.2, maintainers rate it Medium

What the Pillow advisory, the CVE record, the fix commit and the 13.0.0 release notes state about CVE-2026-112900, how the scores differ, and what an attacker needs beyond a filename.

Thursday 22 October

A dark panel with a notice that this briefing has been withdrawn for rewriting.

Market and Supply Chain22 Oct 2026

LiteLLM 1.107.0 compromise: this briefing is withdrawn; its figures, indicators and commands were not supported

Why this LiteLLM briefing was withdrawn, what LiteLLM's own posts say about the 21 October compromise, and where the corrected briefing is.

Wednesday 21 October

Market and Supply Chain21 Oct 2026

Google Cloud and NVIDIA say A5X Vera Rubin instances reach GA next month, with up to 960,000 GPUs planned

What Google Cloud and NVIDIA published on 21 October 2026 about A5X instances on Vera Rubin NVL72, what NVIDIA's datasheet lists for memory, NVLink, rack power and cooling, and what neither company states.

AI-assisted editorial illustration of server modules being moved inside a data centre. Text says 16 managed AI model IDs reach their retirement date and notes that no outage was observed here.

Market and Supply Chain21 Oct 2026

Google Cloud's 16 managed model IDs reach retirement date. Find the one in production

The complete 16-ID inventory, what Google's retirement wording means, where self-deployment differs from MaaS, and the tests to run before routing production traffic elsewhere.

Editorial illustration of an unbranded data-centre desk with a blank table on acrylic, connected server modules and a wordless forecast trace. Headline explains NVIDIA Kumo and Agent Knowledge Foundation.

Market and Supply Chain21 Oct 2026

NVIDIA puts Kumo predictions into its agent stack. A score is not permission to act

The 21 October launch joins structured-data prediction to agent tooling. We separate the four Kumo tasks, earlier model dates, licence differences and the control needed between a prediction and an action.

Tuesday 20 October

Editorial illustration of documents transformed into typed fields and a bounded probability curve.

Market and Supply Chain20 Oct 2026

Cloudflare's Clairic returns typed values in one pass. Its own benchmarks are the first test, not the verdict

Clairic returns typed values and bounded estimates. Cloudflare's latency and cost results are vendor tests, with arithmetic and forecasting limits.

Editorial illustration of punch cards and an old terminal leading to a database and a partly completed test grid.

Market and Supply Chain20 Oct 2026

OpenAI's COBOL result is striking. Its test asks a narrower question than a production migration

OpenAI reports large gains in its own low-resource-language evaluations. The separate build and migration tests have different denominators.

A dark desk in low blue light. A silver laptop on the right shows a plain list of empty rounded rows, the top few tinted amber, with no writing. In front of it lies an unmarked steel padlock with its shackle open, and beside it a steel stopwatch with a plain white dial and one blue hand. The left half is empty dark navy, with the headline and a stat drawn over it: 94 minutes.

Market and Supply Chain20 Oct 2026

OVHcloud CLI: five releases swapped for up to 94 minutes on 19 October 2026, and the checksum list was swapped too

What the public issue, GitHub's release records, the Homebrew tap and OVHcloud's statements show: which files were swapped, which install routes were exposed, what immutable releases do and do not lock, what UK guidance says, and a ranked checklist. Defender level only.

Show 12 more