Next.js patches a critical next/og RCE — upgrade to 16.3.6
CVE-2026-94545 (CVSS 9.5) turns a crafted SVG in ImageResponse into RCE on Node, no exploit yet. Plus DigitalOcean's agent runtime and Ollama thinking dials.
Copy markdown
One SVG in your OG image and the server is theirs
CVE-2026-94545 (CVSS 9.5) lets attacker-controlled values in next/og's ImageResponse — think URL params flowing into an opengraph-image route — break out of Satori's SVG escaping and reach code execution through upstream dependencies. Only the Node.js runtime on Next.js 16.2.0 through 16.3.5 is hit; the Edge ImageResponse and all of 15.x are clear.
The fix is one install, and 16.2 has no patch
Move to next@16.3.6 — there is no separate 16.2 line fix, so 16.2.x apps have to upgrade to 16.3.6. The 15.5.26 release is hardening only, since 15.x was never vulnerable to the RCE. No public exploit or PoC as of Sept 23, so you are ahead of it; if you can't patch yet, keep attacker-controlled data out of SVG content, attributes and styles.
DigitalOcean Managed Agents opens to all
Public preview: run Claude Code, Codex CLI, OpenCode or a LangGraph agent in a runtime that auto-pauses when there is no outgoing LLM or tool call, so you stop paying CPU while it waits. One governed MCP endpoint fronts 16,000+ tools across 500+ providers, and billing is per active CPU-second — roughly $0.06/hr for a lightly-used 2-vCPU session.
Ollama models now advertise their thinking dials
Ollama 0.34.3's GET /api/show now reports each model's thinking controls and default, so a client can set reasoning effort without hardcoding per-model quirks. The release also adds MLX-accelerated vision for Nemotron H on Apple Silicon.