Compromised eMudhra keys trigger urgent updates across developer tools

Compromised eMudhra certificate keys prompted emergency action across Python, Go and JetBrains tools. Linux and GNU Savannah security disclosures added to the patching pressure, while Linux 7.2 reached end-of-life and Microsoft set retirement dates for two developer cloud services.

Key developments

Certificate compromise spreads across tools

Python shipped five expedited releases—3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18—to distrust compromised eMudhra intermediate CA keys, while Go issued its first URGENT-track security release. JetBrains urged updates across its tools; the 2025.2.6.* IDE updates fix JBR, with disabling JCEF advised until a separate hotfix arrives.

An IDE update alone does not cover every affected component, leaving some users dependent on a temporary workaround.

Oct 26–30 · Python Insider · The Go Blog · The JetBrains Blog

Remote Linux flaw exposed

Anthropic disclosed a remotely exploitable use-after-free bug affecting Linux systems with open multipath TCP listeners. The flaw involves a race between handling a retransmitted SYN packet and establishing a connection in another thread.

Exposed multipath TCP listeners create a remote-code-execution risk for affected systems.

Oct 30 · LWN.net

Savannah access enables maintainer impersonation

Hacktron demonstrated code execution on GNU Savannah’s backend using a crafted email address, then elevated its account to superuser and impersonated Bash’s maintainer. The researchers demonstrated the potential to push malware into hosted projects, not an actual malicious Bash release.

Control of project-hosting infrastructure can let an attacker impersonate trusted maintainers of foundational software.

Oct 31 · LWN.net

Linux 7.2 support ends

Linux 7.2.15 became the final release of the 7.2.y series, which reached end-of-life sooner than normal; Greg Kroah-Hartman directed users to 7.3.y. Earlier updates included 7.3.1 and fixes across stable branches from 5.10 through 6.18.

Systems staying on 7.2.y will no longer receive stable kernel updates.

Oct 29–Nov 1 · LWN.net · LWN.net · LWN.net

Python JIT heads for removal

Python’s experimental JIT, introduced in CPython 3.13 in 2024, is headed for removal. The steering council had paused development pending an accepted PEP covering maintenance, compatibility and clear success metrics.

Performance work built around the current experimental JIT cannot assume its continued availability.

Oct 27 · LWN.net

Azure developer services get retirement dates

Microsoft will retire Azure Deployment Environments on February 22, 2027, with no successor, directing users toward Bicep or ARM templates. Dev Box retires September 18, 2028, with remaining workloads facing deletion; Windows 365 is not a one-to-one replacement.

Existing environment-provisioning and hosted-development workflows face migrations rather than direct service replacements.

Oct 30 · InfoQ

Rust replaces Android Binder’s C implementation

Carlos Llamas announced the deletion of Android Binder’s C implementation in favor of Rust. Separately, systemd merged Rust support for new leaf components, excluding existing code and components on which others depend.

Rust now has a replacement role in Android’s primary IPC mechanism and a narrowly defined entry point into systemd.

Oct 27–30 · LWN.net · LWN.net

Microsoft patches an exploited Shell flaw

Microsoft’s October security update addresses 1,415 vulnerabilities, including 85 classified as critical and a Windows Shell flaw exploited in the wild. Affected products include Windows, Office, Exchange, .NET and Edge.

Affected development machines and infrastructure face an active exploitation threat as well as critical vulnerabilities.

Oct 28 · InfoQ

Terra cuts coding-model prices

OpenAI launched GPT-6.1 Terra with API prices cut in half and general availability in GitHub Copilot. It targets everyday agentic coding and terminal work at a lower cost than GPT-6.1 Sol.

Frequent coding-agent and terminal workloads gain a lower-priced model option.

Oct 27 · Archive: 2026 - GitHub Changelog · The New Stack

Azure emulator does not enforce security settings

LocalStack’s free Azure emulator entered public preview, accepting existing ARM, Bicep and Terraform configurations without rewrites. Its documentation describes partial service coverage and settings that are stored and returned but do not enforce access restrictions, TLS or network rules.

Passing local tests cannot establish that Azure security controls actually block access.

Oct 31 · InfoQ

Also this week

Code collaboration

• Former GitHub CEO Thomas Dohmke launched Entire, a GitHub alternative with a redesigned approach to pull requests. The New Stack

• Anthropic moved its monorepo from Git to Scion, using server-side operations, content-addressed storage and tiered caches while trading offline independence for less local data. InfoQ

• GitHub recorded 7.4 billion September commits and is adding 4 million CPU cores and 160 PB of storage. The GitHub Blog · The New Stack

• GitHub added webhook delivery IP ranges to the Meta API’s hooks field for use in network allowlists. Archive: 2026 - GitHub Changelog

• A Linux Foundation Research survey found that generative AI halves open-source coding time, while 25% of incoming pull requests are considered “AI slop” and maintainer workloads are rising. Open Source Security Foundation

Coding agents

• GitHub introduced Copilot Fusion for model selection and orchestration, with reported performance above Claude Code at half the API cost. The New Stack

• Google expanded Android development tooling access for external coding agents, including Claude Code and Codex. The New Stack

• GitHub opened a public preview of server-to-server Copilot authentication for GitHub Apps installed on organizations, supporting services and agents built with the Copilot SDK. Archive: 2026 - GitHub Changelog

• DigitalOcean opened public previews of Learning Services and Agent Data Services for building, evaluating and continuously improving AI agents. InfoQ

• Cloudflare’s Auto Router public beta selects models per request, with reported success rates ten points below Claude Opus 5.5 at one-third the cost. InfoQ

• Junie Eco Mode delegates implementation and testing to cheaper models after planning, with two internal benchmarks showing average model-cost reductions of 48% and 57% per task. The JetBrains Blog

• JetBrains reported roughly 70 tokens per second for Junie Local on M5 Max, up from roughly 40, with bursts reaching 107 through Splash and DFlash2 improvements. The JetBrains Blog

• The Agentic AI Foundation added OpenSandbox, Open Responses, Agent Skills and OpenEnv, bringing its portfolio to ten projects. InfoQ

• Anthropic removed Claude Code’s rolling five-hour usage cap for some eligible accounts on its $200 plan. The New Stack

Frameworks and releases

• Microsoft’s MCP C# SDK 2.0 made HTTP servers stateless by default under protocol revision 2026-07-28, with releases through 2.3 adding session features and discovery, OAuth and shutdown fixes. InfoQ

• OpenTofu 1.13 added convert and assume functions to resolve more values during planning, with violated guarantees producing errors during apply. InfoQ

• Microsoft announced separate collaborations with Infragistics and Syncfusion on free, open-source Blazor components and developer tooling, including .NET 11 analyzers in the Infragistics collaboration. .NET Blog · .NET Blog

• Google and Meta open-sourced TorchTPU for native PyTorch on Google TPUs, while AWS released TorchNeuron for Trainium. InfoQ

• Cloudflare, VoidZero and Max Schwenk introduced tsrs, an experimental AI-generated Rust port of TypeScript, claiming up to 8x faster checking while one TypeScript 7.1 beta comparison showed 2.7x. InfoQ

• Node.js released versions 24.22.2 and 26.13.0, both labeled LTS. Node.js Blog · Node.js Blog

• OpenBSD 8.0 added Intel Arc A-Series graphics, ARM64 hibernation, RISC-V improvements, enhanced virtualization and an expanded virtual address space. InfoQ

• PostgreSQL 19 was delayed, with developer Robert Haas attributing release difficulties to AI and describing the delay as relatively short and driven by quality concerns. LWN.net

• Spring projects published first release candidates across Boot, Framework, Data, Cloud, Security, AI and other components during the week of October 19. InfoQ

Cloud infrastructure

• Cloudflare put Workers KV Instant into private beta, reporting p99 reads of 1.62 milliseconds versus 287 milliseconds for classic KV, with limits of 10,000 keys, one megabyte per namespace and one write per namespace per second. InfoQ

• Amazon CEO Andy Jassy said AWS’s large committed capacity is largely sold out through 2027, with some 2028 capacity allocated, while AWS reserves On Demand headroom. InfoQ

• Kubernetes formed a Workload Conformance Working Group to standardize workload runtime behavior and seek input from developers and cluster operators. Kubernetes Blog

• AWS released Apache 2.0-licensed File Mover Express for large transfers between local systems and S3, with parallel transfers, retries, pause and resume, and integrity verification on macOS, Windows and Linux. InfoQ

Identity and security

• Google’s OAuth Platform added DPoP support to mitigate token theft and replay attacks. InfoQ

• Cloudflare opened a closed beta of its rebuilt GeoKey Manager using hybrid ML-KEM-768 and X25519, with keys held in kernel memory on verified regional servers and general availability planned for Q1 2027. InfoQ

• Google opened a Chrome origin trial for email ownership verification without sending a message, starting with Gmail and using server-side validation of signed tokens. InfoQ

IDE workflows

• JetBrains moved its IDE terminal to libghostty to support workloads including coding agents, Neovim, tmux and dashboards using modern terminal protocols. The JetBrains Blog

• JetBrains IDEs in 2026.3 added in-IDE remote session management and SSH connections using native OpenSSH. The JetBrains Blog

What to watch

• Watch for JetBrains’ separate JCEF hotfix and PostgreSQL 19’s revised release schedule; timing for both is not announced.

• Cloudflare plans general availability of its rebuilt post-quantum GeoKey Manager in Q1 2027, following the closed beta.

• Azure Deployment Environments retires February 22, 2027, the first of Microsoft’s two announced developer-service shutdown deadlines.