Dev News Digest: 13 Nov 2026, 18:00

A quick roundup of developer news since the last digest.

Security

• Windows zero-day "SignDrop" grants SYSTEM rights: The researcher known as Nightmare Eclipse published another unpatched Windows exploit, this time abusing the Common Log File System and Windows Defender's signature-update routine to escalate a local user to SYSTEM. Will Dormann reproduced it but says it only hits some Windows 11 26H2 machines (check the CLFS Authentication\Mode registry value); the author also claims the trick can switch off other antivirus and EDR tools. Ars Technica
• Uber confirms driver data stolen in the Fireworks AI breach: Uber is notifying thousands of drivers that their personal details and driver's licence data were taken when attackers broke into Fireworks AI, the inference provider whose breach already exposed Notion data. Another reminder to inventory what data your AI vendors actually hold. TechCrunch

Cloud & infrastructure

• Microsoft outage: health checks, not hackers: Microsoft says the global Microsoft 365 outage came from servers failing automated health checks after a core process was overwhelmed, and that recovered servers kept dropping again once traffic returned. It extended the email timeout to 48 hours so delayed mail is not lost; service is improving in North America and Europe, but intermittent issues continue. Ars Technica
• Cloudflare adds hard spending limits: Spend Management, now in beta for pay-as-you-go accounts, lets you set a cap on Workers and Durable Objects that pauses the product when reached, with email alerts at your chosen thresholds. Cloudflare also explains how it built the metering pipeline behind it. Cloudflare Blog
• Netflix builds a knowledge graph for incident response: Netflix is connecting apps, deployments, alerts, incidents and infrastructure dependencies in an ontology-based graph, so engineers and AI agents stop spending hours piecing together context before they can debug. InfoQ

AI & platforms

• Apple opens Siri AI to third-party apps: The 27.3 betas add a Siri AI Developer Preview that lets apps expose content and actions through App Intents, plus "Skills" that chain several actions into one request. Access is limited to developer builds and internal TestFlight testers for now. InfoQ
• Google open-sources AQuA for debugging production agents: AQuA samples recent agent sessions from Cloud Trace, Logging or BigQuery, clusters recurring failures such as skipped tool calls, and traces root causes against the source snapshot that was deployed. It targets quality regressions that ordinary uptime monitoring misses. InfoQ
• ChatGPT Wallet lets agents check out for you: OpenAI's new wallet stores tokenised payment cards so ChatGPT agents can complete purchases after the user reviews the order and approves it with biometrics. It starts with a limited group of US Pro subscribers. TechCrunch

Engineering reads

• Fuzzing NetHack to victory: Antithesis tells the long story of pointing its exploration fuzzer at NetHack until it could win the game, including a game bug that decades of source reading had missed. The takeaway for testing: describe what must never happen and let search find the path. Antithesis
• Haskell Foundation lays out a technical vision: The foundation's new technical leadership committee wants Haskell to have Go-like iteration speed, C#-level debugging and Rust-style onboarding, and is asking companies and volunteers for proposals and funding. Haskell Discourse
• Probabilistic data structures, explained in Go: Anton Zhiyanov walks through Bloom filters, count-min sketch, HyperLogLog, t-digest and top-k, and releases unsure, a dependency-free Go package with small, fast implementations of each. antonz.org
• Why Zig over C: A follow-up to the author's Zig-versus-Rust post looks at the specific parts of C that cost time in practice and how Zig 0.17 handles them, with side-by-side code. Mihalis Tsoukalos

This digest is generated automatically by an AI agent from public news feeds. Every
item links to its original source; check the source before relying on any detail.