--- title: This Week in Open Source for October 30, 2026 | daily.dev description: This roundup collects open source security, AI tooling and infrastructure news along with upcoming events. Trojanized LiteLLM wheels and GhostAction workflows... canonical: https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week in Open Source for October 30, 2026 | daily.dev og:description: This roundup collects open source security, AI tooling and infrastructure news along with upcoming events. Trojanized LiteLLM wheels and GhostAction workflows... og:url: https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4 og:image: https://api.daily.dev/og/posts/4HxEsKtG4.png og:image:alt: This Week in Open Source for October 30, 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Open Source for October 30, 2026 **[Google Open Source Blog](https://daily.dev/sources/googleoss)** · 7 min read · 0 upvotes · 0 comments ## Summary This roundup collects open source security, AI tooling and infrastructure news along with upcoming events. Trojanized LiteLLM wheels and GhostAction workflows mined git histories across 345+ repos, while two core PHP CVEs scored CVSS 9.2. OpenSSF research finds 66% of companies are unfamiliar with the EU Cyber Resilience Act, and private forks can add over $258,000 in compliance labor. Nearly 200 tracked open source AI contribution policies show over half ban AI-generated PR descriptions and comments. Genkit Go 1.14 adds typed human-in-the-loop tool approvals and cost budgets, TorchTPU brings native PyTorch support to TPUs validated on 5,000 Hugging Face models, and llm-d 1.0 ships multi-tenant flow control built by 500+ contributors. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities were found in core PHP and how severe are they? Two core PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were uncovered with dual CVSS scores of 9.2, indicating critical severity. They were found alongside trojanized LiteLLM wheels pushed via leaked GitHub CLI tokens and GhostAction workflows mining full git histories across more than 345 repositories. _Developers patching critical PHP CVEs can track disclosures like these as they land on daily.dev._ ### What does Genkit Go 1.14 add for human-in-the-loop AI agent workflows? Genkit Go 1.14 stabilizes typed human-in-the-loop approvals through a DefineResumableTool API, lets teams set run-wide token and cost budgets that include subagents, adopts OpenTelemetry GenAI semantic conventions for tracing, and loads portable Agent Skills bundles from any Go fs.FS filesystem interface. _Teams building safer autonomous agent pipelines can follow releases like this on daily.dev._ ### How does TorchTPU differ from the older PyTorch/XLA approach for running PyTorch on TPUs? TorchTPU replaces the legacy PyTorch/XLA Lazy Tensor rewrite approach with a native C++ PrivateUse1 backend, TorchDynamo compilation, and a hybrid DeferAndFuse eager mode. It was co-developed by Google and Meta's PyTorch team and validated across 5,000 Hugging Face models running on Tensor Processing Units. _Researchers weighing TPU versus GPU workflows can track infrastructure shifts like this on daily.dev._ ## Similar posts on daily.dev - [This Week in Open Source for September 24, 2026](https://daily.dev/posts/this-week-in-open-source-for-september-24-2026-f0evuxtni) · Google Open Source Blog · 0 upvotes · 0 comments - [OpenSSF Newsletter – October 2026 – Open Source Security Foundation](https://daily.dev/posts/openssf-newsletter-october-2026-open-source-security-foundation-ly3binpyh) · OpenSSF · 0 upvotes · 0 comments - [This Week in Open Source \#15](https://daily.dev/posts/this-week-in-open-source-15-ng8qql9ww) · Google Open Source Blog · 1 upvotes · 0 comments - [Linux Foundation Newsletter: June 2026](https://daily.dev/posts/linux-foundation-newsletter-june-2026-nmals0hch) · Linux Foundation · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#ai-agents](https://daily.dev/tags/ai-agents), [#kubernetes](https://daily.dev/tags/kubernetes), [#pytorch](https://daily.dev/tags/pytorch) [View this post on daily.dev](https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Open Source for October 30, 2026","url":"https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4"},"datePublished":"2026-10-30T19:44:32.600Z","dateModified":"2026-10-30T19:45:04.437Z","description":"This roundup collects open source security, AI tooling and infrastructure news along with upcoming events. Trojanized LiteLLM wheels and GhostAction workflows...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/94dd41c2fab0fd7c9d64f1a8b4301051?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/94dd41c2fab0fd7c9d64f1a8b4301051?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Open Source Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Open Source Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a87f457bf1a481b80c313f66a71200b","url":"https://daily.dev/sources/googleoss"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,ai-agents,kubernetes,pytorch","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Open Source Blog","item":"https://daily.dev/sources/googleoss"},{"@type":"ListItem","position":3,"name":"This Week in Open Source for October 30, 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-open-source-for-october-30-2026-4hxesktg4#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities were found in core PHP and how severe are they?","acceptedAnswer":{"@type":"Answer","text":"Two core PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were uncovered with dual CVSS scores of 9.2, indicating critical severity. They were found alongside trojanized LiteLLM wheels pushed via leaked GitHub CLI tokens and GhostAction workflows mining full git histories across more than 345 repositories. Developers patching critical PHP CVEs can track disclosures like these as they land on daily.dev."}},{"@type":"Question","name":"What does Genkit Go 1.14 add for human-in-the-loop AI agent workflows?","acceptedAnswer":{"@type":"Answer","text":"Genkit Go 1.14 stabilizes typed human-in-the-loop approvals through a DefineResumableTool API, lets teams set run-wide token and cost budgets that include subagents, adopts OpenTelemetry GenAI semantic conventions for tracing, and loads portable Agent Skills bundles from any Go fs.FS filesystem interface. Teams building safer autonomous agent pipelines can follow releases like this on daily.dev."}},{"@type":"Question","name":"How does TorchTPU differ from the older PyTorch/XLA approach for running PyTorch on TPUs?","acceptedAnswer":{"@type":"Answer","text":"TorchTPU replaces the legacy PyTorch/XLA Lazy Tensor rewrite approach with a native C++ PrivateUse1 backend, TorchDynamo compilation, and a hybrid DeferAndFuse eager mode. It was co-developed by Google and Meta's PyTorch team and validated across 5,000 Hugging Face models running on Tensor Processing Units. Researchers weighing TPU versus GPU workflows can track infrastructure shifts like this on daily.dev."}}]} ```