AI moves into the security loop as Next.js patches critical RCEs

AI
Meta releases Muse Spark Open, an 816B-parameter open-weight MoE model (opens in a new tab)
Meta published weights for a mixture-of-experts model with 42B active parameters and a 1M-token context, aimed at coding and agent work. It runs on vLLM, SGLang, llama.cpp and major hosts from day one, but its licence carries limited commercial terms.
Source: Meta AI
Security
Next.js ships out-of-band patch for two critical unauthenticated RCE flaws (opens in a new tab)
Vercel fixed remote code execution bugs in the use cache feature and the SVG image optimizer, plus a Server Actions DoS, in Next.js 16.4.1 and 15.5.28. Some advisories have no CVE and may not appear in npm audit, so upgrade and check sharp's version.
Source: The Hacker News
Dev Tools
GitHub makes AI Scan for pull requests generally available (opens in a new tab)
The scanner flags likely vulnerabilities in PR diffs for code CodeQL misses, including PHP, shell scripts, Terraform and Dockerfiles. Findings are advisory and never block merges; it is free on public repos, while private repos need Code Security and consume AI credits.
Source: GitHub Changelog
Regulation
FTC opens AI safety probe of OpenAI and Anthropic with civil investigative demands (opens in a new tab)
The demands, each over 50 pages, cover security incidents, safeguards, marketing claims and privacy policies, and OpenAI says it will engage. It is fact-finding, not a finding of wrongdoing, but lab safety practices that downstream products depend on now face formal scrutiny.
Source: Axios
Business
TSMC posts record Q3 profit, up 69%, and guides Q4 revenue to $52.3B to $54.3B (opens in a new tab)
Net income rose 68.7% to NT$763 billion on revenue up 50.9%, with 3nm and 2nm chips making up 41% of wafer revenue. The guidance signals that AI accelerator demand, and the GPU and cloud capacity built on it, is holding into year end.
Source: TSMC (SEC filing)
Open Source
Canonical releases Ubuntu 26.10 with Rust coreutils and Sequoia PGP for APT (opens in a new tab)
The interim release ships Linux 7.3, completes the switch to Rust-based uutils coreutils, and verifies APT packages with Sequoia instead of GnuPG. Teams should test container and CI images now, since these changes are headed for the next LTS.
Source: Canonical
Cloud
Cloudflare launches Void, an open-source Vite-based full-stack deploy platform (opens in a new tab)
Built by the VoidZero team behind Vite and Rolldown, now part of Cloudflare, Void combines an SDK, CLI and self-hostable platform that infers database, queue and AI bindings from code. It puts Cloudflare in direct competition with Vercel for framework-centric hosting.
Source: Cloudflare Blog
Business
Cohere signs letter of intent to acquire Prague-based AI security startup AISLE (opens in a new tab)
The Canadian AI lab plans to build a Cohere Cyber unit around AISLE, which uses AI to find software vulnerabilities, with terms undisclosed and the deal not yet closed. Model-driven bug hunting is becoming a product line enterprise AI vendors want to own.
Source: AISLE

My take

The through-line today is that AI is becoming part of how software gets secured and judged, not just how it gets written. GitHub is putting an AI scanner on every pull request and Cohere is buying a team that hunts bugs with models, while the FTC is asking the labs themselves to account for their own security incidents. Yet the story that should change your week is the Next.js patch: unauthenticated RCEs in a framework this popular, some invisible to npm audit, matter more than any model launch. Treat AI scanning as an extra reviewer, not a substitute for knowing your dependency tree and patching fast.