Node.js 26, 24 and 22 get security fixes on November 11
The Node.js project announced security releases for the 26, 24 and 22 lines on November 11, with a high-severity issue. Teams on Node 20 or 25 get no fix.
Photo by Alexander Tsang on Unsplash
Radar
News on PHP, WordPress, JavaScript, cloud platforms and AI agents, explained in a few minutes: what changed, who is affected and what to do.
Next.js 16.4.5 and 15.5.29 fix caching bugs that can leak data between tenants
The November Next.js security release fixes seven vulnerabilities, four of them in caching. Teams using Cache Components with per-tenant, per-locale or per-user data should upgrade first.
Photo by Yoav Hornung on Unsplash
WordPress 7.1.4: core update flaw added to CISA's exploited vulnerabilities catalog
CISA added CVE-2026-119977 to its exploited vulnerabilities catalog. It affects WordPress 4.7 to 7.1.3 during core updates and has been fixed since 7.1.4.
Photo by Preston Bousley on Unsplash
Fixed CDN pricing still depends on the usage tier
Vercel now offers a fixed monthly CDN price, with capacity tiers and protection against temporary spikes. The rules for moving between tiers still affect future costs.
Photo by Zhaoli JIN on Unsplash
Astro 7.3 can simplify logging in custom integrations
Astro 7.3 passes the runtime logger to custom image services and cache providers. The change matters when those integrations are part of your operational setup.
The Vercel incident and the cost of an integration with too much access
The April attack on Vercel exposed a dependency worth reviewing: OAuth integrations. Granting access means deciding who owns it and how to take it away.
Managed Agents trades custom infrastructure for explicit lock-in
Anthropic's managed offer charges for runtime and includes sandboxing, state, and credentials, shortening deployment while concentrating operations in one provider.
The WebAIM Million exposes the cost of unreviewed code
WebAIM found 56.1 detectable errors per home page in 2026. AI can increase output, but accessibility depends on the acceptance bar.
contrast-color() moves an accessibility decision into CSS
Chrome 147 can choose black or white from a background color, simplifying dynamic components while retaining limits that require progressive enhancement.
PHP 8.5.5 fixed incorrect results in the JIT
A JIT bug could return incorrect arithmetic values without stopping the process. The incident calls for a configuration inventory and differential tests.
WordPress 7.0 changes editing, administration, and AI connections
Real-time collaboration, DataViews, and Connectors move WordPress toward a shared platform while adding new requirements for plugins, hosting, and governance.
Builder 2.0 bets on collaboration over running code
Builder 2.0 brings product, design, and QA onto the same branch as coding agents, reducing handoffs while moving the bottleneck to review and coordination.
Claude Mythos turns security capability into an access problem
Project Glasswing restricts a model built to find unknown vulnerabilities, showing that evaluation, disclosure, and access have become product concerns.
MemPalace puts domain experts inside the software cycle
The work between Milla Jovovich and Ben Sigman matters less as a curiosity than as a model for turning domain knowledge into a software product.
ACF 6.8 makes custom content readable by machines
Schema.org mapping and Abilities API integration expose WordPress structures to search engines and agents without replacing editorial governance.
Laravel 13.2 attributes move the model contract to the top
New Fillable, Guarded, Hidden, and Table attributes leave Eloquent behavior intact while making configuration and review more explicit in large codebases.
FigJam and Copilot turn corporate context into diagrams
The Microsoft 365 integration lowers the cost of converting PRDs, email, and chats into diagrams while creating new responsibilities for authorship and maintenance.
Dynamic Workers changes the shape of agent tooling
Cloudflare lets agents load generated code into V8 isolates. The advantage comes from composing calls, provided that network access, bindings, and costs remain constrained.
Fail-closed changes the governance model for Claude Code
Claude Code 2.1.92 can block startup without current corporate settings, exchanging local convenience for a verifiable access policy.
MySQL 8.0 is out of support: the risk starts with inventory
MySQL 8.0 reached end of life in April. Moving to 8.4 LTS requires finding forgotten instances, testing real workloads, and preparing a safe rollback.
PAO removes PHP test noise before it fills agent context
The library turns PHPUnit, Pest, and ParaTest output into compact JSON for coding agents, reducing a context cost that grew with every passing test.
Anthropic's cutoff reveals the real cost of third-party agents
Ending Claude Code subscription access for tools such as OpenClaw forces companies to separate convenience, API consumption, and financial predictability.
Interop 2026 narrows the gap between native support and libraries
Five vendors aligned on 20 areas and measure progress with public tests. Teams can remove polyfills and JavaScript only after validating support for their real audience.
Pattern matching could change how PHP describes complex data
The is-operator RFC proposes declarative shape checks and value extraction. Still under discussion, it should guide experiments rather than release plans.