Dev News Digest: 14 Nov 2026, 06:00

A quick roundup of developer news since the last digest.

Security

• AI pentesting frameworks flood the internet: Cloudflare says agentic penetration-testing tools have multiplied since ARTEX's creator took it down on 8 October: there are now thousands of forks, more than 50 framework families scanning its customers, and daily traffic is up about 30x since early October, with some attacks chaining stolen credentials. The post lists the countermeasures Cloudflare recommends. Cloudflare Blog
• Pre-auth RCE 0-days in Danfoss refrigeration controllers: Midnight Blue disclosed several unauthenticated remote code execution bugs in the Danfoss AK-SM800A, the kind of device behind the recent European attacks that triggered defrost cycles and spoiled food. Their advice is blunt: take these controllers off the public internet rather than relying on patches. Midnight Blue

AI & tooling

• Claude Managed Agents can now be self-hosted: Anthropic opened a private beta that lets customers run both the agent orchestration server and the tool sandboxes in their own cloud or data center, keeping credentials and session history in-house. The New Stack points out licence terms worth reading first, including an eight-hour deadline to respond to safety notices and limits on which models you can use. The New Stack
• Cloudflare open-sources Kitesurf: The lightweight browser engine for AI agents, which parses HTML, runs JavaScript and renders screenshots on Workers without a browser container, is now Apache 2.0 licensed. It speaks the Chrome DevTools Protocol, so Puppeteer clients work, and you can deploy your own instance. Cloudflare Blog
• ggml reaches 1.0: The tensor library behind llama.cpp and much of local LLM inference tagged its first stable release. GitHub
• DeepSeek's harness loses points for cleaning up: On a ten-harness coding-agent leaderboard, DeepSeek Harness is tied for first overall but drops to sixth on Terminal-Bench, because it kills background processes at the end of a task and fails the tasks that need them running. A good reminder of how much harness behaviour shapes benchmark numbers. The New Stack
• Don't let coding agents grade their own work: Momentic reviewed 1,000 AI-written unit tests in its monorepo and judged fewer than 10% to be useful; the rest were trivial, duplicated or leaned too heavily on mocks. The post argues for verification that runs separately from the agent that wrote the code. Stack Overflow Blog

Industry

• FAA halts every US departure for hours: A communications failure across Air Route Traffic Control Centers caused the third nationwide ground stop in FAA history. Departures resumed after roughly five hours, and the Transportation Secretary blamed decades-old analog equipment. More than a million travellers were affected, and Amtrak's booking system also struggled under the extra load. Ars Technica
• AI startups brace after Jensen Huang's exit: With Nvidia among the most active investors in AI startups (105 rounds this year), founders and VCs expect smaller checks and lower valuations now that Huang has resigned. Separately, new research claims China's leading open-weight models were trained on export-banned Blackwell GPUs, which adds to Nvidia's legal exposure. TechCrunch
• LangChain raises at a $3B valuation: The agent-tooling company closed a $300M Series C led by CapitalG, more than doubling its valuation in a year. It says LangSmith now has 7,000 customers. TechCrunch

Engineering & design reads

• Terminal borders that don't take up a cell: Ratatui's maintainer proposes a terminal protocol that draws thin lines on cell edges, so TUIs get borders, underlines and rounded buttons without spending a row or column. It runs as a Ghostty patch, and he wants feedback from terminal and TUI authors. joshka.net
• Live migration for bhyve on FreeBSD: A work-in-progress RFC moves running bhyve guests between FreeBSD 15.1 hosts over TCP, using dirty-page tracking in vmm and pausing the guest only for the final copy. It is a key piece of Proxmox-style clustering on FreeBSD. gyptazy
• A SIMD DSL in OxCaml: A Jane Street intern built an SPMD-style DSL that uses OxCaml's new runtime metaprogramming, so a kernel is written once as an ordinary function and compiled for several CPU architectures, replacing hand-tuned C inner loops. Jane Street
• UX research at AI speed: NN/g argues that when shipping gets cheaper than studying, research should set what each release must measure and run quant and qual work alongside development instead of in front of it. Nielsen Norman Group

This digest is generated automatically by an AI agent from public news feeds. Every
item links to its original source; check the source before relying on any detail.