Wednesday, 11 November 2026
Six Git CVEs including arbitrary code execution; memory safety bugs found in Rust's standard library; AI coding speed gains don't reach delivery lead time
Today's Lead
EngineeringGitHub Blog
Git security vulnerabilities announced
The Git project released fixes for six security vulnerabilities. Two of them can lead to code execution or memory corruption. Update to Git 2.56.1 or a patched backport release. If you cannot update, avoid recursive clones of untrusted repositories.
Engineering
FORGE Lab
Memory Safety Bugs in Rust Standard Library
Microsoft's FORGE Lab found soundness bugs in the unsafe code of the Rust standard library (std). Some bugs are reachable from safe Rust code. The lab used an artificial intelligence (AI) scanner to help find them. The bugs come from three kinds of misplaced trust: panics, user-provided trait implementations, and the underlying system.
LeadDev
Your engineers got twice as fast. Your lead time only moved 4%
Engineers used artificial intelligence (AI) tools and wrote code nearly twice as fast. Total lead time fell by only about 4%. Writing code made up only about 10% of the lead time. The author says teams must measure where work waits, such as code review and decisions, and must measure delivery, not only AI adoption.
The Pragmatic Engineer
Software correctness & supply chain security, with Sean Allen
Gergely Orosz interviews Sean Allen, a distinguished engineer at Antithesis, about software correctness. Allen defines correctness as software that does what its builders expect. Teams often do not know what working means until a failure occurs. He prefers verification over manual checks, and he wants the type system to block illegal states. For distributed systems and databases, tests need designed workloads, because random operations rarely reach edge cases.
VulnCheck
After 7 months, Glasswing overwhelms maintainers with underwhelming findings
Patrick Garrity of VulnCheck reviews Anthropic's Project Glasswing seven months after its launch. He counts 442 Common Vulnerabilities and Exposures (CVE) entries linked to Anthropic, about 0.5% of 2026 CVEs. Only two of these entries appear as exploited in the Known Exploited Vulnerabilities (KEV) catalog. Garrity says open source software (OSS) maintainers now carry most of the triage work, and fixes have stalled. He concludes that artificial intelligence (AI) can find bugs, but the evidence does not support the launch claims.
kate.land
Using voltage glitching to unleash the A100 in my mining card
The author used voltage fault injection (VFI) to unlock a restricted NVIDIA graphics processing unit (GPU). The target card has 80 gigabytes of high bandwidth memory (HBM), but NVIDIA restricted it with fuses. Most sampled cards gained the full 80 gigabyte memory, and all functional streaming multiprocessors (SMs) are enabled.
Humanities
JSTOR Daily
In Defense of the Humanities
Maria Papadouris argues that the humanities remain necessary in a culture that values career skills. Simone de Beauvoir's memoir helped her understand her grief after her grandmother died. A 2018 study shows that humanities training builds empathy. The author says the field must show its value by addressing artificial intelligence (AI) and biotechnology.