Category / T-CAT / SOFTWARE
Software
Software / T-2026-9571
CVE-2026-101148: A CVSS 10 WordPress Backup Plugin That Never Got a Fix
BackupSheep's WordPress plugin scores a perfect 10 on CVSS and has no patch. The AI tooling ecosystem runs on exactly this kind of abandoned dependency.
SourceCVE-2026-101148 (CVSS 10 CRITICAL)
Software / T-2026-6551
OpenAI's Python SDK adds custom voice creation and agent session events
openai-python v3.24.0 adds custom voice creation and agent session events, plus routing fixes. The SDK is quietly becoming an agent runtime.
Sourceopenai/openai-python v3.24.0
Software / T-2026-8083
TileLang adds Huawei Ascend 950: the kernel DSL is quietly going multi-vendor
TileLang's Ascend 950 backend turns a CUDA-first kernel DSL into a multi-vendor compiler. Here's why that's the interesting part.
Sourcetile-ai/tilelang
Software / T-2026-3370
CodeGraph cuts agent token use 62%, then quietly eats your context window
CodeGraph's 2026-08 benchmark shows 62% fewer tokens and zero file reads on seven repos, alongside 80% more residual context in long sessions.
Sourcecolbymchenry/codegraph
Software / T-2026-7606
Next.js 16.3.8 patches a high-severity SSRF and five cache bugs that matter for AI
Next.js 16.3.8 fixes an SSRF in Image Optimization plus five cache-layer flaws. For AI builders shipping generated content, the cache bugs are the real story.
Sourcevercel/next.js v16.3.8
Software / T-2026-9989
NVIDIA's OpenShell puts a kernel between your agent and your secrets
NVIDIA's OpenShell is a sandboxed runtime for autonomous agents that enforces file, syscall, and network policy at the kernel and formally verifies policy changes.
SourceNVIDIA/OpenShell
Software / T-2026-4056
Anthropic SDK v1.9.0 Ships claude-sonnet-5-5 and a between_tools Thinking Mode
Anthropic's Python SDK v1.9.0 adds claude-sonnet-5-5, a between_tools thinking type, streaming tool execution, and GA cache diagnostics.
Sourceanthropics/anthropic-sdk-python v1.9.0
Software / T-2026-6675
openai-python v3.20.0 ships agent sessions and WebSocket snapshot opt-in
openai-python v3.20.0 adds Agents credential and session options, Cyber access programs in Responses, and incremental WebSocket snapshots. A read on what the plumbing implies.
Sourceopenai/openai-python v3.20.0
Software / T-2026-2133
OpenRig Runs Claude Code and Codex as One Team, and Rewrites Your Config to Do It
OpenRig orchestrates Claude Code and Codex seats in tmux from a YAML spec. The interesting part is what it writes to ~/.claude.json and ~/.codex/config.toml.
Sourcemvschwarz/openrig
Software / T-2026-6781
StarNet makes the pixel-art space station the actual agent runtime
StarNet is an MIT-licensed desktop agent harness where the station layout is the workflow. A look at what it gets right, and where the metaphor could bite.
SourceandrooAGI/starnet
Software / T-2026-8484
Vectorize's Hindsight Claims State-of-the-Art Agent Memory, With Virginia Tech and WaPo Reproducing the Numbers
Hindsight, Vectorize's open-source agent memory system, claims top LongMemEval scores with independent reproduction from Virginia Tech and The Washington Post.
Sourcevectorize-io/hindsight
Software / T-2026-6293
LangChain's 1.6.5 Patch Is a One-Line Fix for a Bug That Breaks Agents
LangChain ships langchain-core 1.6.5, a two-commit release that abbreviates long tool IDs in XML buffer strings and quietly patches a class of agent failures.
Sourcelangchain-ai/langchain langchain-core==1.6.5