AI & Tech News Digest — October 26, 2026

AI NewsTop 5

• Moonshot Apologizes and Resets Quotas After Kimi K3.1 Pro Launch Issues (Oct 26)

  ReutersKimi blog

  The follow-up to last week’s 3T-class launch: Moonshot apologized Monday for rate limiting and “unnecessary quota consumption” after K3.1 Pro — the 2.8T-parameter, 1M-context model scoring 65.7% on Terminal-Bench 4.0 — swamped its own infrastructure, and is resetting affected subscriber quotas. The API models remain at $2/$10/$0.20 per million tokens, with K3.1 Pro Highspeed promising 2–3× throughput, and full open weights still due Nov 4. If you ran Kimi Code or the API during the launch window, check your quota before assuming you burned it.

• JetBrains Open-Sources ThinkRail, a Real IDE Built Around the pi Coding Agent (Oct 25)(196 points)

  GitHubHN discussion

  JetBrains’ entry in the harness wars is Apache-2.0 and already at ~2k stars: a thin host that runs the pi agent in-process (pi keeps models, skills, compaction, cost, and sessions; a Bun.serve engine host bridges it to a React 19 UI, with an Electrobun desktop app and a thinkrail CLI that serves the same app in your browser). The workflow pitch: every task becomes a git worktree workspace with its own branch and a shelf that files it after the PR merges, a connected graph of SPEC.md files the agent reads and maintains through dedicated spec_* tools, and MCP servers gated behind per-call approval. Your existing Agent Skills are read in place, and PRs flow through your own gh. Spec-first agent IDEs are now a product category.

• OpenAI and Anthropic Cut LLM Prices Up to 80% in Four Months — the Math Is Cache Reads (Oct 25)(228 points)

  minimaxir.comHN discussion

  Max Woolf’s timeline walks the tit-for-tat: GPT-5.6 Sol launched at $5/$30/$0.50 in June, GPT-6.1 Sol now sits at $2/$10/$0.10 — 75% cheaper cumulatively — while Claude Opus 5.5 landed 40–60% below Opus 5 “because it requires less compute to serve.” The key number: for coding agents, cache reads are 96–99% of total token spend at 90–100% hit rates, so Anthropic’s 75% cache cut on Fable 5.1 was worth more than any headline input/output price drop. On OpenRouter, DeepSeek V4.1-Flash-1017 is now hosted by 29 providers at $0.15/$0.60/$0.003, and Woolf argues that competitive floor — not IPO-window loss-leading — is what keeps prices falling. Budget your agent fleets against effective cache-read cost, not list price.

• The State of Context Engineering: New Models, Same Six Fixes, Two New Failure Modes (Oct 24)(127 points)

  dbreunig.comHN discussion

  Drew Breunig’s AGNTCon talk surveys where the discipline landed in 2026: the original four failure modes (poisoning, distraction, confusion, clash) are still handled by the same six tools — augmentation, tool loadout, quarantine, pruning, offloading, summarization — now mostly baked into harnesses. What’s new: “fighting the weights” (models overfit to their training harnesses; Claude Code’s system prompt begs for parallel tool calls seven times because serial behavior is baked in) and “context inertia,” where agents hyper-focus on a failing hypothesis — Anthropic’s Memento harness clears the context every 90 minutes while keeping the environment, and Berkeley’s “Scaling Discovery Requires Forgetting” shows the same reset producing repeated performance jumps. His operational advice stands: past ~200k tokens, delete your context before blaming the model.

• IBM’s CEO: Open-Weight Models Are Now “Irresistibly Good and Cheap” On-Prem (Oct 22)(118 points)

  The RegisterHN discussion

  Arvind Krishna’s pitch to enterprises, resurfaced on HN over the weekend: open-weight models have crossed the threshold where running them on your own hardware beats per-token API spend for serious workloads. Coming from the company selling exactly that infrastructure, it’s a sales line — but it tracks what MiniMax’s $0.15/$0.60 Flash pricing and Kimi’s weights-drop cadence are doing to the buy-vs-run math. If your 2027 planning still assumes every model call leaves the building, it’s worth a re-run of the numbers.

Also tracked: Hurston-1, an Apache-2.0 narrowband TTS tuned for Southern American and regional African English, trained on 136 hours of fully consented recordings from a 20k-speaker dataset — huggingface.co/destined/hurston-1 | HN.

Developer & DevOps NewsTop 5

• Gheist: 13,500 Planted Workflows Draining GitHub Secrets at Scale (Oct 25)

  WizHN discussion

  Since September 15, Wiz has tracked a campaign committing a sync-check.yml workflow to every repo stolen tokens can reach — 13,500+ branches across 850+ compromised accounts, personal and enterprise. The payload base32-encodes the secrets context so GitHub’s log masking misses it, exfiltrates through GitHub’s own API (no C2 to block), and a self-hosted-runner variant goes further: 31 token formats including AI provider keys, /proc/*/environ, the Docker socket, and Kubernetes service-account tokens. GitHub’s July 28 approval-hold stopped every public-repo run cold, but private repos and Enterprise Server have no such hold, and the attack was still evolving as of Oct 24. Hunt for ci-sync-* branches, the gheist user agent, and OIDC role assumptions from those branches — and rotate, because deleting the run doesn’t un-leak the secrets.

• DreamHost Forces Password Resets for Email and FTP Users After Multi-Day Incident (Oct 23–25)(136 points)

  DreamHost statusHN discussion

  What started Oct 23 as File Manager connectivity issues became a precautionary reset of email and FTP/SFTP passwords, with resets completed Oct 24 and notification emails still going out Oct 25; files.dreamhost.com remains offline. DreamHost won’t say “breach,” but precautionary credential resets are never about a config typo. If you host mail or sites there: set new passwords directly in the panel (up to 15 minutes to propagate), treat any reset email containing a login link as phishing, and note the ops lesson — their incident comms correctly told users to wait for the reset wave before changing passwords themselves, so early changers got overwritten.

• France Prepped ISP DNS Blocks of Snapchat, TikTok, and Instagram for Oct 24 (Oct 25)(149 points)

  BlastHN discussion

  Blast reports the Prime Minister’s office asked four French ISPs to prepare temporary DNS-level blocks of major social platforms — Snapchat, TikTok, Instagram among them — to trigger if the protest wave turned violent again on Oct 24. The blocks were prepared, not executed, but the posture is new for a Western democracy: platform reachability as a public-order lever, decided at the resolver. The 175-comment thread covers what operators already know: DNS filtering is trivially bypassed with DoH or a VPN while quietly breaking every naive resolver in the path.

• October Cumulative Update Bricks a Handful of Windows 11 25H2 Fleet Devices (Oct 25)

  r/sysadmin

  A admin reporting from a ~5,000-device Windows 11 environment: after KB5127648, a handful of machines fail pre-kernel with 0xc000000d and won’t boot at all. Small percentage, absolute nightmare per machine — and the usual October-CU pattern. If you patch rings by exposure rather than by risk, this is the week to hold the 25H2 ring on boot-critical hosts until the failure signature and a fix are documented.

• Removing Next.js Got a Blog 100 on Every Lighthouse Category (Oct 26)

  korindiehacker.bloffy.blogHN discussion

  A blogger strips the framework out of a personal site and posts perfect scores across all Lighthouse categories; the 46-comment thread turns into the recurring debate over what Next.js is actually doing for a content site versus what it costs in hydration, bundle size, and build complexity. Not an argument against Next.js for apps — just a reminder that “default to the meta-framework” is a decision, not a law.

Self-Hosting & HomelabTop 4

• android-ad-cleaner: The Debloat Wave Moves From TVs to Chinese Android Phones

  GitHub

  1,087★ in two days. The same pattern that hit Android TVs arrives for phones: an ADB-driven, no-root, fully reversible pass that disables the system ads, hot-search feeds, content recommendations, and marketing pushes baked into ColorOS, HyperOS, MagicOS, and OriginOS. Per-ROM package lists, one restore script, and an agent-friendly setup so Claude Code or Codex can run the whole pass from a prompt. Check the device list before you start — and take the backup snapshot it offers seriously.

• cleanyourtv-app: Run the Clean Your TV Debloat From Your Phone, No Laptop Needed

  GitHub

  628★. A community-built Kotlin companion app for the 24k★ cleanyourtv project: point it at your Fire TV or Google TV over ADB-on-Wi-Fi and run the debloat from the couch — no laptop, no coding agent, nothing uninstalled. The main project’s CLI flow stays the power path, but this drops the barrier for the “I just want the ads gone” crowd, which is most of the crowd.

• gdirect: Direct-Download Google Drive Files With a Rust CLI

  GitHub

  618★, GPL-2.0, out Oct 25. A Google Drive direct downloader built on a pinned libaria2, for the hoarder workflow: pull large shared files and archives straight onto a server or seedbox at full speed without the browser dance. Small tool, obvious place in any media-server pipeline.

• Bridgeplay: A Free Fork of NotProton Puts Windows Steam Games in Mac Steam

  GitHub

  514★, GPL-3.0. Runs Windows Steam titles on macOS through CodeWeavers’ Wine and Apple’s Game Porting Toolkit, presented inside Mac Steam like native games. After NotProton’s licensing drama, a community fork that keeps the workflow free is exactly how these projects survive — read the compatibility list before you buy anything new for it.

Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: the GPU tensor-unlock research that started with RTX 4090 firmware is spreading — nlzy/turing-unlock unlocks full-speed FP16 tensor cores on Turing, and KohakuBlueleaf/KohakUnlock documents Ampere reproduction notes (176★).

Hacker News Top Stories

1. Oregon Police Are Charging a Local News Outlet $2.5M for Records About One Cop(443 points, 120 comments)

   The Interceptdiscussion

   A public-records fee quote as a paywall: the pricing of one misconduct file shows how request costs have become a censorship tool.

2. I refuse to accept a censored Internet. Join Me at FOSDEM 27(433 points, 207 comments)

   talkweb.eudiscussion

   A call to turn platform-blocking and filtering fights into a proper FOSDEM track — landing the same weekend France prepped ISP DNS blocks.

3. AI use leads UC Berkeley math professor to see ‘no point’ in grading homework(210 points, 308 comments)

   Daily Caldiscussion

   When every submission can be machine-written, the feedback loop breaks; the thread works through what assessment even means now.

4. fheroes2: A recreation of the Heroes of Might and Magic II game engine(204 points, 71 comments)

   GitHubdiscussion

   A decade-long open-source engine rebuild that plays the original campaign with modern resolutions — still shipping.

5. Nikon photography contest winner loses title after scientists spot signs of AI(138 points, 75 comments)

   TechSpotdiscussion

   Forensic analysis stripped a winning photo of its prize — provenance checking is becoming an actual profession.

6. Proton Flock Camera Map(100 points, 20 comments)

   Protondiscussion

   A crowdsourced map of Flock ALPR cameras, following MapQuest’s effort — surveillance infrastructure, mapped by the people under it.

7. iPhone Duo Teardown(88 points, 49 comments)

   iFixitdiscussion

   iFixit opens up the two-screen iPhone contraption making the rounds; the comments do the thermals and specs math.

Also tracked: “What Adobe v ArtCraft teaches us” (88 points, 98 comments) — a read of the creative-tools lawsuit and what it implies for how OpenAI and Anthropic court professional customers — techbronerd.substack.com.

Reddit HighlightsTop 5

• r/sysadmin — OCT 2026 Exchange Updates (Delayed Issues)

  Thread

  Exchange SE queues filling up after the October CUs; the thread collects the DISM-repair and policy-refresh workarounds before Microsoft documents them.

• r/opensource — “Your tokens aren’t valuable no more AI”

  Thread

  The subreddit bans solo projects and LLM-built submissions outright; the moderation crackdown is the sharpest community reaction to slop-flooded showcases yet.

• r/LocalLLaMA — Is it just me or Kimi K3.1 Pro don’t look much better…

  Thread

  Community benchmarks push back on the launch benchmarks; the real verdict arrives with the Nov 4 weights.

• r/dreamhost — IMAP email down for hours

  Thread

  The user-side view of the password-reset incident: dead IMAP, surprise reset emails, and confusion over which instructions are real.

• r/BuyFromEU — France asked ISPs to prepare temporary DNS blocks

  Thread

  Europeans compare DoH resolvers and VPS egress as the reality of state-level filtering moves from piracy courts to social platforms.