Category / T-CAT / SOFTWARE
Software
Software / T-2026-7025
LiteLLM's Rust core is the quiet bet that AI gateways are infrastructure now
BerriAI's LiteLLM now ships a Rust core, an independent litellm-core distribution, and first-class A2A, MCP, and Claude Code harness support. What that says about the AI stack.
SourceBerriAI/litellm
Software / T-2026-0835
CVE-2026-106145: Telerik Report Server Lets a Guest Account Become a Trusted Agent
Telerik Report Server before 12.2.26.1007 lets a low-privilege user register as a trusted service agent and collect encryption keys. The AI stack runs on this plumbing.
SourceCVE-2026-106145 (CVSS 7.1 HIGH)
Software / T-2026-1251
Anthropic's Python SDK v1.13.0 Quietly Ships Multi-Agent Plumbing
Anthropic's anthropic-sdk-python v1.13.0 adds multiagent configuration and thread status filtering to Managed Agents, plus analytics types. The quiet release says a lot about…
Sourceanthropics/anthropic-sdk-python v1.13.0
Software / T-2026-6427
openai-python v3.28.0 adds agent environment suspension and expiration
The openai-python 3.28.0 release ships agent environment suspension and expiration, a small API change that says a lot about how agents are being run in production.
Sourceopenai/openai-python v3.28.0
Software / T-2026-1282
Anthropic's Python SDK v1.12.0 Ships Haiku 5.5 and Typed Computer-Use Tools
Anthropic's anthropic-sdk-python v1.12.0 adds claude-haiku-5-5, typed computer and browser tool calls, and model lifecycle fields. The quiet release is the interesting one.
Sourceanthropics/anthropic-sdk-python v1.12.0
Software / T-2026-3789
cmux bets the terminal, not the orchestrator, is where AI agents belong
Manaflow ships cmux, an open-source Ghostty-based macOS terminal built for running many AI coding agents at once, and its design philosophy is the real story.
Sourcemanaflow-ai/cmux
Software / T-2026-9413
DeepGEMM's Ascend port is the tell: DeepSeek is writing kernels for chips it may never buy
DeepGEMM added an Ascend backend on Sept 30. DeepSeek is quietly loosening its dependence on NVIDIA, and the kernel library is the evidence.
Sourcedeepseek-ai/DeepGEMM
Software / T-2026-5045
llama.cpp v0.6.0 ships a batch API for models that don't just predict tokens
llama.cpp v0.6.0 adds llama_batch_ext, GLM-5.3-Flash, a /v1/systemone decision-model API, and Metal kernels that speed mat-mul up to 3x on Apple GPUs.
Sourceggerganov/llama.cpp v0.6.0
Software / T-2026-3027
CVE-2026-103913: a WordPress map plugin turns coordinates into an SQL injection
A CVSS 7.5 SQL injection in the GeoDirectory WordPress plugin shows why AI systems that ingest scraped geodata inherit every bug in the pipeline that feeds them.
SourceCVE-2026-103913 (CVSS 7.5 HIGH)
Software / T-2026-6924
pstack-claude Ports Lauren Tan's Cursor Skill Stack to Claude Code, Codex, and Pi
A new MIT-licensed port brings Lauren Tan's pstack agent workflows to Claude Code, Codex, Pi, and beyond, testing whether agent skills can survive outside their home harness.
Sourcemichael-denyer/pstack-claude
Software / T-2026-0687
Cloudflare Open-Sources an 'OS' Where Every User Gets Their Own AI-Built App
Cloudflare OS is an open-source agent workspace where every document is a private app, and Gatekeepers add a new human-in-the-loop model for agent approvals.
Sourcecloudflare/cloudflare-os
Software / T-2026-8394
CVE-2026-1661: WP Mail Logging's 4.3 Is a Warning for Every AI Agent That Reads Email
WP Mail Logging before 1.17.0 renders logged email HTML and CSS in its admin screens, letting unauthenticated attackers inject styled links. The lesson for AI tooling is bigger…
SourceCVE-2026-1661 (CVSS 4.3 MEDIUM)