Forgejo <=16.0.3 hit by critical RCE — patch to 16.0.4/15.0.8 now
A malicious template repo can run code on your Forgejo host. Also: Claude Code 2.1.268, SageMaker prefix routing, NVIDIA's open BioIR, Apple photo proofs.
Copy markdown
A poisoned template repo owns your host
Forgejo's “generate from template” feature (CVE-2026-60004) lets template variable expansion re-create a .git folder, handing a malicious template arbitrary file reads and code execution on the server. Everything up to 16.0.3 is affected — patch to 16.0.4 (stable) or 15.0.8 (LTS), both out Sept 10, especially if strangers can create repos on your instance.
Claude Code 2.1.268: WebFetch stops hanging
WebFetch now hard-stops at 300 seconds instead of blocking your agent indefinitely, `--remove-session-state` wipes a session's on-disk directory, and `/plugin` gains `--json` output with error details. Gateway admins can also serve managed `pricing:` from gateway.yaml. Update off 2.1.267.
SageMaker keeps your KV cache warm
New prefix-aware routing sends requests that share a prompt prefix to the same instance, so the KV cache stays hot — on Llama 3.1 70B, P50 time-to-first-token dropped up to 77% and cache hits jumped from ~25% to over 80%. It's an endpoint-config flag (PrefixLength, ConcurrencyThreshold), no code change, made for RAG and multi-turn bots.
Build this weekend: 2.9x faster protein folding, open source
NVIDIA open-sourced BioNeMo Inference Runtime (BioIR), a PyTorch-native accelerator that folds 58.5K residues per GPU-hour on 8xH100 — 2.9x the throughput of the stock Boltz-2 setup — via custom kernels, CUDA Graphs and Ray. Clone it from GitHub and run structure prediction at scale on your own hardware.
Elsewhere: iPhones will cryptographically prove a photo is real
Apple's “Reference Image,” shipping Sept 18 on iPhone 18 Pro, signs raw sensor data into a verifiable “digital negative” that proves a shot wasn't AI-generated or edited — a content-provenance primitive builders can verify against. It rolls out in 65+ countries, minus China at launch and disabled in the EU.