Bricksforge attacks, Deno joins Cloudflare and a Gemini agent

Deno joins Cloudflare, and Deno Deploy shuts down in six months

The whole Deno team is joining Cloudflare, Ryan Dahl announced on 9 October. Deno Deploy will run for about six more months, then shut down. Paying customers get help moving to Cloudflare Workers.

The Deno runtime gets about one more year of monthly bug and security fixes. “After that year we will end our development of the Deno runtime,” the post says. It stays open source, and others can carry it on. JSR, the JavaScript package registry, keeps running on Cloudflare. The post does not mention the Fresh framework.

Why it matters If a site or API runs on Deno Deploy, start planning the move now. Six months goes fast.

My take: I will miss Deno Deploy. It made small APIs easy. Workers is a good home, though.

New to Cloudflare? My Cloudflare 101 guide walks through the free plan.

Read the full story on Deno

Citrix fixes critical NetScaler SAML flaw CVE-2026-107406

Citrix has fixed a critical memory flaw in NetScaler ADC and NetScaler Gateway. It can let attackers run code or crash the device. Only appliances set up as a SAML identity provider or service provider are at risk. Citrix says it knows of no attacks yet.

The fixed versions are 14.1-73.46, 13.1-64.29, 14.1-FIPS 14.1-73.46 and 13.1-FIPS or NDcPP 13.1.37.283, or later. Shadowserver counts about 21,000 NetScaler devices open to the internet.

Why it matters NetScaler flaws have been attacked again and again this year. If your login runs through NetScaler with SAML, patch this week.

Read the full story on BleepingComputer

Next.js will ship a critical security update on 14 October

Next.js will release a special security update on Wednesday 14 October 2026. It fixes three flaws in upstream dependencies. Two are rated Critical and one is High. Two of the fixes were held back from the September release.

The team will publish the details, affected versions and upgrade steps on the day.

Why it matters You get a few days’ warning, so use them. Book time on 14 October to update and redeploy every Next.js site you run.

Read the full story on Next.js

Google launches Gemini as one agent for all your work

At Gemini at Work 2026 on 8 October, Google announced Gemini as “a single, universal agent for work”. It answers questions, writes and runs code, and makes images and media. It works inside Gmail, Docs, Sheets, Slides, Chat and Calendar, plus Slack, Microsoft 365 and the command line.

Gemini picks a model for each job. Today that means Gemini and Anthropic’s Claude models. Companies can also give an agent its own identity and email address, like a coworker. Admins can set a hard spending cap, and the agent pauses when it hits it. Google gave no prices or launch date for the agent itself.

Why it matters AI agents that do whole tasks are moving into the office tools you already use. The spending cap is a smart idea, and I want every AI service to copy it.

Read the full story on Google Cloud

Anthropic offers free AI security scans for open-source projects

Anthropic launched OSS Scanner on 8 October. Core maintainers of critical open-source projects can sign up for free, regular security scans by its best models. Each report has a proof of concept, an explanation and a suggested fix where possible.

The reports go out with no human review, so some may be wrong. Anthropic expects more than 90% of findings to be real bugs.

Why it matters Most WordPress plugins and JavaScript packages are built by a few volunteers. Free scans could catch bugs like today’s Bricksforge flaw before attackers do.

Read the full story on Anthropic

Google opens a fast lane to Search for forums and social sites

Google has a new UGC Fresh Data Program, documented on 8 October. Approved forums and social platforms can send new posts and engagement numbers to Google through their own data pipeline. It is separate from the Indexing API and normal crawling.

Platforms need public post pages with stable URLs, lots of users and active moderation. They also need valid SocialMediaPosting or DiscussionForumPosting markup. You apply with a form and should hear back in 6 to 8 weeks.

Why it matters Google wants fresh human talk in its results. If you run a big community site, apply. If you don’t, check that your forum markup is valid anyway.

Read the full story on Google Search Central

SEOs see more Google manual actions on real businesses

Manual action consultant Marie Haynes says requests went from “essentially no requests to several per week”. She says most are thin, spam or scaled content cases, often on long-running, legitimate businesses. Daniel Foley Carter reports a rise over the last few months too. Google has not confirmed any change.

Why it matters Mass-made AI pages are catching up with people. Open Search Console and check Manual actions today. If you have one, clean up fully before you ask Google to review it.

Need a starting point? Here are five SEO fixes you can start this week.

Read the full story on Search Engine Roundtable

Safari Technology Preview 254 can animate to height auto

Safari Technology Preview 254 came out on 8 October. It adds interpolate-size and calc-size(), so you can animate an element to and from height: auto. It also adds the new size shorthands and symbols(), and fixes grid, line-clamp and relative colour.

For known fingerprinting scripts, Safari now reports 4 or 8 CPU cores at random.

Why it matters Smooth open and close animations for menus and FAQs with no JavaScript are getting close in every major browser.

Read the full story on WebKit

Apple confirms a “Welcome home” event for 13 October

Apple will hold a press event in New York on Tuesday 13 October at 9am ET. That is midnight on 14 October in Melbourne. The teaser from Greg Joswiak says “Welcome home”.

It is an in-person “Apple Experience” for press, and it is not clear if a full video goes online. The rumours point to a new Apple TV 4K, a “HomePad” smart home hub and a HomePod mini 2.

Why it matters If you were waiting to buy an Apple TV or HomePod, wait a few more days. That is what I would do.

Read the full story on 9to5Mac