Gemini’s free tier shrinks, Asus router fixes and Kolibri-1

Asus fixes a router flaw that runs commands from a VPN file

Asus has patched two flaws in its router firmware. The worst is CVE-2026-14157, rated CVSS 9.4. A crafted VPN config file uploaded through the router’s web admin can run any command. The second, CVE-2026-13313 (CVSS 8.9), lets a logged-in attacker switch on Telnet with root access.

Firmware 3.0.0.6_102 has both flaws. Firmware 3.0.0.4_386 and 3.0.0.4_388 have the Telnet flaw. No attacks have been reported.

Why it matters Your router guards every device in your home or office. Update the firmware now, and only import VPN files from sources you trust. If your Asus router is too old to get updates, use a strong admin and Wi-Fi password.

Read the full story on Tom’s Hardware

Beaver Builder 2.11.0.6 fixes a shortcode flaw that needs no login

The Beaver Builder page builder for WordPress has a flaw, CVE-2026-92084, published on 3 October. The CVE record rates it CVSS 9.1. Someone with no login can run any shortcode on your site. Versions up to and including 2.11.0.5 are affected.

There is a catch for attackers. Your site needs a Beaver Builder Sidebar module that shows content they control, like a Recent Comments widget. The comment must also be approved, or moderation must be off. WPScan rates the risk lower, and no attacks are known. The same release also fixes a SQL injection for Contributor accounts.

Why it matters Shortcodes can do almost anything a plugin allows. Update Beaver Builder to 2.11.0.6 or later, and keep comment moderation on.

Read the full story on The Hacker Wire

Aleph Alpha’s Kolibri-1 is a free model you can run yourself

German AI company Aleph Alpha released Kolibri-1, an open-weight model for English and German. It has 78.1 billion parameters, but only 3.46 billion work on each token. It reads up to about 1 million tokens at once. The licence is Apache 2.0, so you can use it in commercial work.

It has four reasoning levels, from none to high, and supports tool calling. You host it yourself with vLLM. The model card says you need at least two A100 or H100 cards. It reached the top of Hacker News over the weekend.

Why it matters If your clients want their data to stay in their own servers, this is a strong new option. For most small sites, a hosted API is still cheaper.

Read the model card on Hugging Face

Google stops some bug bounty reports after a flood of AI junk

Google has paused product vulnerability reports to its open source bug bounty, the OSS VRP. The pause started on 1 October and runs until at least early 2027. Google blamed a wave of invalid reports written by AI. Supply chain reports are still accepted.

Google isn’t alone. Intel has also paused its bug bounty, and Linux maintainers say they are swamped by AI-made bug reports.

Why it matters Fake reports waste the time that should go to real flaws. If you run a security inbox for your own product, expect more of this. Ask for a working proof before you spend hours on a report.

Read the full story on Tom’s Hardware

Simon Willison wants hard spending caps on every cloud service

Developer Simon Willison argues that cloud services and APIs should stop at a spending limit by default. AI coding agents can run up big bills while you sleep. A warning email, he says, is not enough. Turning the cap off should be an opt-in choice.

He points to AWS, which launched monthly spend limits that pause a project in September. Google Cloud added per-service Spend Caps in July. His post was one of the top stories on Hacker News.

Why it matters I agree with him. If you let an agent touch your hosting, set a hard cap today. Then check where your keys are stored. My guide to picking a cloud server covers the basics of costs.

Read the full post on Simon Willison’s blog

Nolan Lawson asks why developers don’t use the web platform

Web developer Nolan Lawson asks why so many developers still pick npm packages over built-in browser features. His answers are old habits from when browsers were behind, comfort with React, and the fun of building things yourself. Package READMEs also used to be easier to find than MDN pages.

He says AI coding tools could go either way. They could pick native web APIs, or spread more custom code. He has seen both.

Why it matters Every package you skip is less JavaScript to load and less code to update. Fewer scripts also help your speed scores. My post on Core Web Vitals explains why.

Read the full post on Nolan Lawson’s blog

Apple will reportedly launch its smart home hub on 13 October

Bloomberg’s Mark Gurman reportedly says Apple will announce a smart home hub on Tuesday 13 October. A new HomePod mini and new Apple TV models are also expected, according to the MacRumors weekly roundup.

The hub reportedly has a 6-inch square screen and a FaceTime camera. It can sit on a bench or mount on a wall. Rumoured colours are Silver, Space Gray, Starlight and Rose Pink.

Why it matters If you were about to buy a HomePod mini or Apple TV, wait a week. New models usually mean better deals on the old ones too.

Read the full story on MacRumors

Nvidia raises the Shield TV Pro price by 50% after seven years

Nvidia’s Shield TV Pro went from US$199.99 to US$299.99 on 2 October. Nvidia said “the cost of components, including memory, has increased substantially across the industry.” The cheaper standard Shield TV is gone. The Pro is now the only Shield streamer.

Why it matters A seven-year-old box now costs more than it did at launch. Memory prices are pushing up the cost of all sorts of kit. If you want a home media box, a Raspberry Pi 5 is a cheaper path. Here’s how I’d build one.

Read the full story on Tom’s Hardware