A new tool called Corgi was shown on Hacker News as a terminal multiplexer designed to manage both human workflows and AI agents like Claude Code, Codex, Pi, and OpenCode in one interface. It tracks agent status (working, needs attention, finished, idle), keeps sessions and processes running in the background, and shows file changes and token usage per workspace. Corgi is installable via a curl script and supports features like image pasting over SSH, worktree organization, and scripting via a '--skill' command.
Spotify is enforcing its longstanding rule that Family and Duo plan members share the same address by prompting users to scan a QR code on the plan manager's device. Users who don't scan within seven days are demoted to the free tier and barred from joining another Duo or Family plan for 12 months. Spotify's support documentation confirms the policy after users reported the prompts on Reddit.
A three-person data platform team at a roughly 500-person company built a side tool in February to host HTML files generated by AI coding assistants like Claude Code. Eight months later, that tool reportedly has as many or more weekly users as the company's Looker business intelligence subscription, while Looker usage has dropped by about a third.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 in severity, affect most PHP builds and were patched by the PHP Project on Wednesday. Security firm Wiz, which found the flaws with AI assistance, says PHP runs on roughly 70% of websites worldwide, and the bugs allow memory disclosure and unauthenticated remote code execution independent of the application running on PHP.
The PHP team released PHP 8.6.0 RC4, the third release candidate in the 8.6 cycle, which patches two critical vulnerabilities that could allow unauthenticated remote code execution. Users running earlier 8.6.0 builds are urged to update immediately, though the team stresses RC4 remains a test build not meant for production use. A further release candidate, RC5, is planned for 5 November 2026.
In a short essay, computer scientist Edsger Dijkstra critiques the idea of programming computers using natural human language instead of formal symbolic languages. He traces the history of programming languages, noting how high-level languages improved error detection compared to machine code, but argues that the underlying machines remain literal and unforgiving 'slaves' regardless of the language used. Dijkstra contends that proposals to let people instruct machines in their native tongue misunderstand the fundamental nature of programming.
Hugging Face released Carbon-X, the latest model in its Carbon family, which lets researchers paste a DNA sequence and ask questions about it in plain English. Research scientist Lewis Tunstall said the model excels at predicting mutation effects and completing DNA sequences, and can run locally rather than through a cloud service. It can also be paired with other AI agents, according to Tunstall.
Spotify is using QR codes that refresh every few seconds to confirm that Family Plan subscribers live together, blocking screenshot workarounds some users relied on. Reddit users say they've still managed to scan the codes remotely via video calls. Spotify co-CEO Alex Norström said on a Thursday earnings call that this is a routine update to verification methods, not a new crackdown.
A developer has published agent-usage-guard, a modification for Claude Code that intervenes before prompts, tool calls or subagent fan-outs run, aiming to prevent a five-hour usage window from being exhausted in minutes. The tool reads Claude Code's own 5-hour and weekly usage percentages, prompts the user for approval when possible, and refuses actions when no one is available to answer. It runs entirely locally, storing only counts and coarse buckets rather than prompt or output content.
Spotify confirmed on its Q3 earnings call that it is rolling out QR code verification for Family Plan members, requiring them to scan a code from the plan manager's phone to prove they live together. Members who miss the seven-day verification window lose access and must wait 12 months before joining another Family or Duo plan, or switch to an individually paid plan. Co-CEO Alex Norström described the change as a routine update to existing verification tools rather than a crackdown.
Security researchers discovered that Indian certificate authority eMudhra issued six TLS and two code-signing intermediate certificates whose private keys were weak enough to be guessed or recovered. An attacker exploiting this could impersonate trusted websites such as banks or tech firms, or sign malware to appear as legitimate software from companies like Microsoft or Google. The affected certificates now need to be revoked and removed from trust stores across operating systems and browsers.
Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
GoKawiil