What Edu is reading this week (Nov 8 - 14, 2026)

Posted on Nov 14, 2026

A week of milestones and one very public outage: KubeVirt graduates at the CNCF after ten years of putting virtual machines inside Kubernetes, Red Hat ships OpenShift 5 as an in-place update from 4, and Microsoft took Outlook, Teams and other services down for millions of users on 12 November before restoring them. Around them, a race condition in mod_http2 to patch, a campaign that used stolen GitHub tokens to push a secret stealer into tens of thousands of repositories, llama.cpp reaching 1.0, and the cheap SDR running out of parts.

Cloud, Kubernetes and Infrastructure

  • CNCF Announces KubeVirt Graduation - Ten years after the project set out to run virtual machines inside Kubernetes, KubeVirt reaches graduated status. The foundation frames it as production maturity for organisations that want VMs, containers and AI workloads on a single platform, and the announcement came at KubeCon and CloudNativeCon North America in Salt Lake City.
  • Red Hat OpenShift 5 - Generally available, and an in-place update from OpenShift 4. Lightspeed grows from a conversational assistant into an agent that handles autonomous troubleshooting and pre-flight update risk assessments, and the release adds MCP server support, AI interfaces, post-quantum control plane security and a longer, more predictable lifecycle, with AI, VM and container workloads side by side.
  • AWS Emulator - AWS publishes its own local emulator of the AWS APIs, written in Rust: no account, no GUI, point the CLI or any SDK at the emulator endpoint through environment variables, or embed it as a dev dependency with one isolated instance per test. The README is explicit that it is for building and testing, not production or security testing, and each release ships fidelity scores per service.
  • ZKeys / zkeys CLI - Remote key custody for unattended infrastructure: the client fetches keys from a ZKeys server to unlock encrypted pools and filesystems, so the material never lives on the machine and a stolen disk stays closed. Key management is deliberately kept out of the CLI and restricted to the web UI.
  • LFX Insights - The Linux Foundation’s analytics site for open source project health: contributor, security and activity metrics across more than 13,000 projects, with curated collections of the most critical projects measured by contributor volume and software value. Free, and useful before you bet a dependency on a project.

AI, Models and Agents

  • llama.cpp v1.0.0 - llama.cpp and ggml move to libraries v1.0.0 and adopt semantic versioning for real: a major bump now means a breaking change to the public C API under ./include, minor covers backends and model support, patch is a bug fix. The post also maps the distribution channels (Docker, Debian, Homebrew, conda-forge, MacPorts, Winget, XCFramework) and the self-hosted CI runners from NVIDIA, AMD, Qualcomm, Arm, IBM and Intel.
  • llama-modchip - 3.00 to 3.75 bpw vector and dyadic quantisation aimed at MoE models on CPU alone: DeepSeek-V4 284B inside 59 GiB of RAM, and a 30B MoE at 22.4 tok/s single stream and up to 111.6 with speculative decoding, on a 64 GB machine with no GPU. Apache 2.0, with a quality gate, PPL and KLD figures and a community CPU leaderboard.
  • Craft Anything - Point it at a website, app or game, say what you want, and it studies the original with real inspection tools, has a coding agent build a clean-room version in Rust, then checks the result against the original and refines it. Early alpha, MIT or Apache 2.0, builds for macOS, Windows, Linux, FreeBSD and the web.
  • Gemini Decisions API - A new Gemini Decision 1 model behind an API for classification-shaped work: up to 1,000 yes/no, multiple choice or rubric-scoring questions in a single pass over text, images, audio, video and PDFs, with confidence scores. Built for routing queries, grading content and checking policy rules.
  • Gemini 4 Hydrogen and Orchestrator - Hydrogen arrives in Google Antigravity next to a new Orchestrator option that pairs it with the strongest models, Carbon included, for long-horizon tasks. The post ties it to this week’s /swarm work on parallel agent teams across worktrees and says tens of thousands of swarms have been launched already.
  • Patch the Planet With Nix and Agents - Geoffrey Huntley’s talk from New York: attackers scan and exploit new commits automatically, so defenders now need more inference capacity than their attackers have for autonomous purple teaming, and most companies have not budgeted for that. His answer is engineering rather than more AI: keep a trusted core of kernel, DNS and crypto, vendor or agent-build the rest, and use Nix for one source of truth across laptops, CI, agent sandboxes and production.
  • ponytail-sec - Andy Pitcher’s security plugin for coding agents, built around “the smallest change that ruins an attacker”: it reviews your last change, trims code and dependencies, and points at the single fix that breaks the chain. Installs from the plugin marketplace or the Antigravity CLI, with a click-through demo of every command.
  • HDAE - Human-Directed Agentic Engineering, the method behind Ginux, packaged as portable skills for Codex and Claude Code: the human sets intent, architecture, constraints and acceptance gates, the agent implements and verifies inside those bounds and stops at each boundary with evidence. The installer writes skills into .hdae/skills with checksums and links them into .agents and .claude, preserving local edits.

Linux, Desktops and Systems

  • Omarchy 4.5 - The first big release since Quattro: 740 pull requests from more than 180 contributors in twelve weeks. Traditional desktop mode arrives next to the tiling default, native installs work on M1, M2, M3 and Neo MacBooks, it speaks 50 languages, and Super+L now cycles a workspace between tiling, scrolling and floating.
  • Dux - A desktop suite rather than a distribution: a shell with widgets and dynamic theming, a keyboard-first file manager with tabs, split view and network shares, a system and process monitor, and a greetd greeter. Tuned for niri, Hyprland, mangowm, Sway and Miracle WM.
  • Solnix - Nix meets illumos: machines declared in Nix and the NixOS module system, each generation mapped onto a ZFS boot environment, SMF instead of systemd, atomic upgrades and instant rollback. There is a signed binary cache, full-text package search and a handbook, though this is preview grade and no stable edition has shipped.
  • What I run on my $10 OpenStick homelab / HN discussion - A ten dollar computer the size of a USB stick, running Debian, systemd and Podman as a silent, low power home server: AdGuard Home with blocklists that stop about 60% of his DNS queries, a Cast client that skips sponsorships, and Zeroclaw at roughly 3 MB of RSS when idle against the 1 GB OpenClaw wanted. The thread (834 points) asks about the four year old OpenStick repository, a possible jump to a newer kernel and the one click installer at openstick.org.
  • bazzite-touch-unlock - Unlocking a LUKS encrypted Bazzite handheld with no USB keyboard: one small package layered onto stock Bazzite adds the unl0kr on-screen keyboard from BuffyBox to the boot passphrase screen, with an uninstall script and normal Bazzite updates left intact.
  • Ginux / HN discussion / Kurtzer on X - The kernel Kurtzer built in eleven days with AI has changed direction: the UEFI bootable Rust kernel that ran a Rocky Linux 10 userspace is preserved on a branch, and Ginux is now a userspace kernel running as an ordinary host process that puts a versioned, deliberately smaller contract between each instance and the host kernel, emulating, mediating or denying a syscall before it takes effect. The thread (122 points) argues about whether anyone should trust a kernel written this way, and Kurtzer’s own post is candid that he killed the bootable version about a week after announcing it.
  • LogoLight - Swift menu bar app for the glowing Apple logo on MacBook Pro models with the PROLED XDR display: on and off without a password, brightness, Breathe, Pulse and Heartbeat effects, battery and charging indicators, and Morse code. MIT, notarised, and in a Homebrew tap.

Security

  • wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories - From 12:45 UTC on 10 November, stolen GitHub tokens pushed a payload into every repository they could write to: a dependency audit pull request first as a probe, then commits carrying the real payload. Aikido counted 61,839 probe pull requests and evidence the script ran in at least 1,806 repositories, with run logs deleted afterwards. It is a 1,500 line shell script that collects secrets, escalates, persists and exfiltrates, and it has already reached a Packagist and a Go package through automated publish triggers.
  • Critical RCE Vulnerability in Apache HTTP Server - A race condition in mod_http2’s assign_headers() when threads share resources lets a remote unauthenticated attacker corrupt the heap and get code execution as the web server user. Found independently by Anthropic and Google Cloud’s vulnerability research team, fixed in 2.4.71 or in standalone mod_h2 builds newer than 2.0.42, and Wiz puts 64% of cloud environments in the vulnerable range with 51% publicly exposed. No exploit is public yet.
  • Lock your GitHub Actions - Hugo van Kemenade replaces the “pin every action to a full SHA” advice with lockfiles: the gh-actions-lock extension rewrites workflows to version tags and records the resolved commits in .github/workflows/actions.lock, both are committed, and a separate CI job verifies the lockfile is current. Update tooling refreshes it, and he reminds you to use cooldowns.
  • zizmor - Static analysis for workflows and action definitions, with a high signal default and pedantic and auditor personas when you want everything. SARIF output plugs into GitHub code scanning, there is an action for CI, and it runs offline by default.
  • 2FA removed from Humble Bundle / SpaceBattles thread - The new Humble Bundle site went live without two factor authentication, which the SpaceBattles thread describes as taking the whole security setup out behind the shed: no token is requested at login, so the password is the only factor left.
  • I deleted all my SSH keys - Moving from ed25519-sk YubiKeys and a few leftover on-disk keys to secure enclaves: YubiKey, TPM and the Apple Secure Enclave holding or wrapping all key material, so nothing unprotected lives on disk. The author is clear that this is one way to do it, not the only way.
  • Terminal2Shell - The joke of the week: a design-level vulnerability in terminal emulators, present since 1971, CVSS 11.0 out of 10, no patch available, and the proof of concept is the shell embedded in the page. Exploitation steps are “open a terminal”, Microsoft Paint is the one product listed as not affected, and the mitigations suggest typing slower.

Hardware, Homelab and SDR

  • The Cheap SDR Is Disappearing - The tuners inside cheap SDRs are running out: Rafael Micro has wound down the R828D used in the RTL-SDR Blog V4, which the blog announced as end of line in May 2026, and the R820T2 before it, the V4L is a limited run from a stockpile, Mirics’ MSi2500 and MSi001 read zero stock at JLCPCB and LCSC from February to November, and mirics.com no longer resolves. The HackRF’s MAX2839 is obsolete too, so the 30 dollar entry point into the spectrum is closing.
  • Using voltage glitching to unleash the A100 in my mining card / r/LocalLLaMA - Voltage fault injection on the GA100 die lets you blow arbitrary fuses, which turns a CMP 170HX 8GB into something that behaves like an A100 80G and benches about 1.2x faster than retail, because every functional SM is enabled (120 to 126, die lottery depending, against the 108 NVIDIA sells). NVLink, PCIe Gen4, NVJPG, NVDEC and MIG unlock the same way.
  • Hijacking Samsung TV Smart Hub Ads / samsung-tv-adspoofer - A 2022 Samsung TV started serving ads on the Smart Hub home screen again after a homelab change broke his Pi-hole, so he went further: thanks to the eMudhra CA certificate incident, a fake implementation of the ad server can be trusted by the TV. The resulting Rust service serves his own pictures in place of the ads.
  • Making a €40 USB-C hub work as a Nintendo Switch 2 dock - The Switch negotiates power, enters DisplayPort alt mode and even gets pin assignment D acknowledged, then refuses to output until a vendor defined USB-PD exchange happens. He captured it with a WITRN K2 sniffer and a Claude written Linux CLI, then patched the hub’s VL103 8051 controller through fwupd’s vli plugin, disassembling with Ghidra, assembling with SDCC and testing in uCsim.
  • Smart home devices should work without the internet - Ten years of one rule: no core device depends on a vendor’s server, so everything keeps working when the connection drops. The stack is Tasmota on ESP8266 and ESP32 boards, an MQTT broker and Node-RED on a Raspberry Pi, with cloud services only as optional extras, plus notes on the triangle between a cheap cloud camera, privacy, and a plug you flash yourself.

Gaming, Handhelds and Cars

  • Ocarina Recomp - Ocarina of Time’s code translated to C and compiled as a native Windows program, with the Switch 2 graphics converted to Vulkan, all built on your machine from your own copy. The project changed direction in November: it now points at Hookshot, which renders at a higher resolution for the same cost and takes its fixes, while this repository stays as a Portuguese language support point. Saves carry over, and it is experimental, tested on one machine at about 59 fps standing still.
  • MAKO Decky v5.0.0 (Phoenix) - Bundled MAKO frame generation reaches the Decky plugin through the matching renderer: open weight FG for SteamOS and Linux, where 3x can turn 30 fps into 90 when game and GPU sustain it, with 2x, 4x and other output schedules, free for non commercial use and no Lossless Scaling install required. Frame generation model is chosen per profile and power mode.
  • decky-optiscaler v0.0.9 / repository - Unofficial fork of danielcamilo1’s Decky plugin that brings OptiScaler v10 and FSR 4 Lite to the Steam Deck: install, configure and monitor OptiScaler per game from Game Mode, no desktop mode and no manual file copying, with the settings OptiScaler can change live applied to the running game.
  • Volta OS - An in-car infotainment interface for Linux in Qt 6 and QML that is also its own Wayland compositor, so Wine, Bottles and gamescope apps open inside the UI instead of next to it. Navigation with traffic, lane guidance and speed camera alerts, YT Music, Spotify Connect, podcasts and radio, CarPlay and Android Auto through a Carlinkit dongle, and an arcade for parked sessions. Beta, GPLv3, AppImage, and unrelated to Tesla.
  • Ugark Vibes - A Playdate adventure built around the crank: pull it sharply to start an old Niva, hold it at an angle to change gear, find the rhythm that keeps a street organ playing. You play a couple fixing up an old house in a village in Armenia, with a cat, a dog and a second cat along for it.
  • Habbit - A Playdate app that turns the handheld into a desk companion: habits, tasks, workouts and reading in one place, plus a small bird that grows along with them. Fully offline, no account, saved locally, four dollars, and the optional game needs the crank.

Web, Science and Misc

  • The Secret of Monkey Island: all 13 versions side by side - Eight editions and thirteen display modes of the 1990 game, captured in ScummVM (the Atari ST mono screens through Hatari), with the same twelve scenes in every version, scaled to 1600x1200 with nearest neighbour pixels and 4:3 correction. Drag the windows around to compare the machines.
  • Fold ‘N Fly - A database of paper aeroplanes with folding instructions, video tutorials and printable plans, sorted by difficulty and by what each design is for: distance, time aloft, acrobatics. The classics are there next to the OmniWing and the Sonic Jet.
  • 93% of Paint Splatters are Valid Perl Programs - A SigBovik paper that answers a question nobody asked: is it possible to smear paint on a wall without producing valid Perl? OCR says only 93% of splatters parse, so yes, and the page links the paper and a gallery of the resulting programs.
  • Astronomers Found a Mysterious Object Orbiting Far Beyond Pluto - 2026 ED138 turned up in Vera C. Rubin Observatory data, orbits on a plane tilted about 25 degrees from the main planets (which suggests Neptune nudged it) and takes roughly 280 years per orbit. Matthew Holman found it while sifting the survey; its size is still unknown, and that is what decides whether it counts as a dwarf planet.
  • BuildCores - A 3D PC part picker: start from a build, swap parts, and get compatibility checks, price comparison and a look at the assembled machine in 3D. The data covers around 38,800 compatible parts, and the site is upfront that the figures are illustrative rather than benchmark results.
  • .name Grandfathered - After a long and expensive fight, Verisign has dropped its plan to terminate 22,000 third level .name domains and email redirects. New registrations close, but existing domains and redirects stay indefinitely, and Neil Fraser credits the people who filed reconsideration requests and made the case to ICANN in person.

Business and News

  • NVIDIA Announces CEO Transition / Huang’s email to employees / Reuters on a second relationship - Jensen Huang resigned as president, CEO and board member effective immediately, with CFO Colette Kress as interim CEO while the board searches for a successor. The trigger is an admitted extramarital affair, which he apologised for in an email to staff, and Reuters reports a second relationship with an employee, with the board investigating.
  • Microsoft outage live updates - Outlook, Teams and other Microsoft services went down for millions of users on 12 November. Microsoft said the underlying issue was addressed, that services were being gradually restored and that this was a technical fault rather than a breach, and apologised for the disruption; the live blog tracks the recovery and the productivity cost.