ChromaDB max-severity RCE CVE-2026-45829 affects 14M monthly download package with no patch

A maximum-severity vulnerability (CVE-2026-45829) in ChromaDB's Python FastAPI server allows unauthenticated attackers to execute arbitrary code on exposed servers. The flaw exists because a vulnerable API endpoint loads and executes a malicious model from Hugging Face before authentication is checked, meaning the payload runs even though the server ultimately returns a 500 error. The bug was introduced in ChromaDB 1.0.0 and affects the PyPI package with ~14 million monthly downloads. Despite being reported in February, the maintainer has not responded to HiddenLayer's disclosure attempts, and it remains unclear whether version 1.5.9 patches the issue. About 73% of internet-exposed ChromaDB instances run a vulnerable version. Mitigations include switching to the Rust frontend, avoiding public exposure of the Python server, restricting network access to the API port, and scanning ML model artifacts before runtime.

Microsoft durabletask PyPI package compromised with credential-stealing worm payload

Three malicious versions of the `durabletask` PyPI package (1.4.1–1.4.3), associated with Microsoft's Azure Durable Task Framework, were found to contain a backdoor dropper injected into Python source files. On import, the dropper silently fetches a second-stage payload (`rope.pyz`) from a freshly registered C2 domain. The payload is a full-featured infostealer and worm that harvests credentials from AWS, Azure, GCP, Kubernetes, HashiCorp Vault, password managers, SSH keys, Docker, and AI developer tool configs. It propagates to other EC2 instances via AWS SSM and to Kubernetes pods via `kubectl exec`. A cryptographically authenticated GitHub dead-drop (using the string FIRESCALE) serves as a fallback C2 channel. On systems with Israeli or Iranian locale settings, there is a 1-in-6 chance the payload plays audio and then runs `rm -rf /*`. Detection artifacts, IOCs, and mitigation steps including credential rotation and network blocks are provided.

PyTorch 2.11 fixes aarch64 CUDA wheel install on NVIDIA Grace Blackwell hardware

PyTorch 2.11 resolves a long-standing packaging issue on aarch64 Linux: CUDA-enabled wheels are now published to the default PyPI index, so `pip install torch` on NVIDIA GH200, GB200, and GB300 systems no longer silently installs a CPU-only build. The post traces the problem from a 2024 hackathon frustration through vLLM's interim workarounds (use_existing_torch.py and uv build isolation config), to a formal fix coordinated via the PyTorch Foundation's Technical Advisory Committee. With PyTorch 2.11, standard install instructions now work out of the box on Grace Blackwell hardware, eliminating the need for custom index URLs and post-install sanity checks for most users.

PyTorch ships ExecuTorch MLX Delegate for GPU-accelerated inference on Apple Silicon

PyTorch has released the ExecuTorch MLX Delegate, an experimental backend that enables GPU-accelerated inference for PyTorch models on Apple Silicon Macs using Apple's MLX framework. It integrates with the PyTorch 2 export stack via torch.export and supports quantization options including BF16, FP16, FP32, and 2/4/8-bit affine quantization via TorchAO. The delegate delivers 3-6x higher throughput compared to existing ExecuTorch backends on macOS. Validated models include dense transformers (Llama 3.2, Qwen 3, Gemma 3, Phi-4 mini), sparse Mixture-of-Experts (Qwen 3.5 35B-A3B), and speech-to-text models (Whisper, Parakeet, Voxtral) for both offline and real-time transcription. The workflow follows the standard ExecuTorch pipeline: export with torch.export, lower with MLXPartitioner, and run the resulting .pte file.

Nuitka 4.1 ships Python 3.14 compatibility and async code fixes

Nuitka 4.1 is a new stable release of the Python-to-C compiler. Key highlights include improved Python 3.14 compatibility (still experimental), extensive async code compatibility fixes, expanded generics support for Python 3.12+, and significant compilation scalability optimizations. The release consolidates fixes from hotfix versions 4.0.1 through 4.0.8, adds new UI options like --recommended-python-version, improves standalone package support for libraries like paddle, scipy, h5py, and flet_desktop, and introduces performance improvements to trace collection, plugin dispatch, and C code generation. Reproducible builds support was also added via a new Scons option.

PyCharm 2026.1.2 adds Pyrefly as an optional LSP type provider

PyCharm 2026.1.2 introduces Pyrefly as an optional external type provider via the Language Server Protocol (LSP). Pyrefly is Meta's next-generation Python type checker rewritten in Rust, replacing the OCaml-based Pyre. It offers significantly faster type inference, type-related diagnostics, quick documentation, and inlay hints compared to PyCharm's built-in engine, resolving files in 0.5–1 seconds. Enabling it is straightforward via the Type widget at the bottom of the IDE. Current limitations include support only for local interpreter configurations, with Docker, WSL, SSH, and multi-module project support planned for future releases.

Apache Flink 2.2.1 ships 44 bug and vulnerability fixes

Apache Flink 2.2.1 is the first bug fix release in the Flink 2.2 series, containing 44 bug fixes, vulnerability fixes, and minor improvements. Key fixes address Flink SQL issues (UNNEST with LEFT JOIN, MultiJoin incorrect results, MATCH_RECOGNIZE parsing, JSON_OBJECT compilation), PyFlink thread mode and virtual environment problems, data corruption with custom partitioners and unaligned checkpoints, sensitive data exposure in debug logs, SSL connection failures with newer JDK versions, and Flink WebUI breakage in Chrome 144+. Improvements include AdaptiveScheduler transition acceleration, splittable timers in Interval Join, and updated cipher suite defaults. All users on Flink 2.2 are strongly recommended to upgrade.

Hudson River Trading joins PSF as Visionary Sponsor

Hudson River Trading (HRT), a quantitative trading firm, has become the Python Software Foundation's newest Visionary Sponsor — the PSF's highest sponsorship tier. HRT joins NVIDIA, Google, Bloomberg, Meta, and Anthropic at this level. The sponsorship funds CPython development, PyPI infrastructure, community programs, and security initiatives. HRT uses Python extensively for research, data analysis, and engineering workflows, and has also contributed to PEP 810 (lazy imports). The firm plans to open source additional projects and announce further OSS contributions later in 2026.

PyTorch 2.12 ships 100x faster batched eigendecomposition and unified accelerator graph API

PyTorch 2.12 has been released with 2,926 commits from 457 contributors. Key highlights include up to 100x faster batched eigendecomposition on CUDA via updated cuSolver backend selection, a new device-agnostic torch.accelerator.Graph API unifying graph capture across CUDA, XPU, and out-of-tree backends, and torch.export now supporting Microscaling (MX) quantization formats for deploying compressed models. The Adagrad optimizer gains fused=True support, and torch.cond control flow can now be captured inside CUDA Graphs using CUDA 12.4 conditional IF nodes. ROCm users gain expandable memory segments, rocSHMEM symmetric memory collectives, and FlexAttention pipelining with 5-26% speedups. Apple MPS gets ahead-of-time Metal-4 shader compilation. TorchScript deprecation continues, and the CUDA 12.8 wheel is deprecated in favor of CUDA 13.0+.

PyCharm 2026.1.1 adds beta support for uv, Poetry, and Hatch workspaces

PyCharm 2026.1.1 introduces beta support for uv, Poetry, and Hatch workspaces, enabling the IDE to automatically detect and manage multi-package Python project structures. Key features include intelligent workspace detection from pyproject.toml files, automatic environment configuration with zero-config SDK setup, continuous environment health monitoring, import gap detection with quick-fixes, and a transparent Python Process Output tool window for tracking executed commands. The feature is opt-in and currently in beta, with plans to expand UI capabilities for creating projects, linking dependencies, and terminal activation.