AI & Tech News Digest — November 14, 2026

AI NewsTop 5

• DeepSeek Opens Its Whole App Stack Through the API — and Open-Sources the Chat Client (Nov 13)

  DeepSeek API docsStartup FortuneGitHub

  The November 13 changelog entry turns the consumer app into a developer platform: web search, multi-step “deep thinking search”, file input (PDF/Office/images), URL reading, and safety checks are now parameters on the Messages, Responses and Chat Completions endpoints using deepseek-flash, with tool calls and context assembly handled by DeepSeek’s service — plus standalone Search/Fetch, OCR, ASR and TTS APIs. The MIT-licensed chat-demo client (TypeScript, 1,100+ stars in a day) rebuilds the app experience and imports your DeepSeek chat history, storing keys and conversations only in the browser. Two catches from the docs: tool-call pricing isn’t published, and public-facing services keep the compliance duties (content-safety review, model registration, AI labeling). The practical read: an app-shaped assistant from one vendor and one bill — but read the pricing page before you commit, because it currently doesn’t exist.

• WSJ: Nvidia Pushed Circular GPU Financing to Keep the Shortage Story Alive (Nov 13)

  TechPowerUpHN, 320 points

  A Wall Street Journal report alleges Nvidia invested in AI startups that would turn around and buy its GPUs and build data centers, sustaining the perception of demand while moving an “avalanche” of wafers from TSMC. The detail everyone is quoting: at an August meeting, CFO — now interim CEO — Colette Kress pushed to scale back circular financing deals including the $250B OpenAI agreement, and Jensen Huang called her a “deer in the headlights” for it. The report lands three days into the post-Huang era and five days before the November 17 earnings call. The procurement angle: GPU commitments from vendor-financed cloud startups are leveraged bets on Nvidia’s balance sheet, so treat their uptime promises and pricing like you’d treat any heavily leveraged supplier.

• ggml Hits v1.0.0 — the Tensor Library Under llama.cpp Gets a Stability Contract (Nov 13)

  Release notesHN, 155 points

  The 1.0.0 tag prunes the deprecated public API and the legacy DIAG_MASK ops, bumps the RPC protocol to v9 so incompatible peers fail cleanly, and adds FP8 support plus configurable YaRN truncation. The performance work is broad: few-row quantized matmuls and MoE fusion on CUDA and Metal, an Intel prefill FlashAttention path on Vulkan, a device-side MoE scheduler on SYCL, decomposed Adreno FlashAttention in OpenCL, new WebGPU kernels, and expanded Hexagon (on-device NPU) coverage — with the scheduler now skipping uploads of inputs nothing reads. Version 1.0 is a promise: the API surface everything building on llama.cpp tooling can code against.

• Claude Code Projects Becomes a Coordinator With Parallel Worker Threads (Nov 13)

  AnthropicHN, 77 points

  Anthropic redesigned Projects around delegation: you set a goal and connect repos, Claude scopes the work, and each task runs in a thread that is a full Claude Code cloud session on its own branch — opening PRs, running tests, with a shared memory and an artifact library accumulating across the week. You can steer from your phone, and the beta rolls out to select Pro and Max subscribers using cloud sessions first. The honest caveat is in Anthropic’s own post: several parallel full sessions reach usage limits faster, and local-machine execution is “coming very soon”. The orchestrator pattern — frontier model directing cheap workers — is now a product feature instead of a setup you bolt together.

• OpenAI Disbands Its Robotics Team as Its General Models Start Running Robots (Nov 13)

  FortuneHN, 158 points

  Fortune reported Thursday that OpenAI shut down its dedicated robotics team, with the stated logic that its general models can now run robots directly. The HN thread is mostly robot companies reading the same tea leaves: platform bets consolidate, and a specialist model that was “coming soon” no longer has an owner. If your robot stack was waiting on a dedicated OpenAI robotics model, that roadmap no longer exists — plan around the general-purpose API.

Also tracked: Claude Meetings entered beta for Team and Enterprise plans, starting with Google Meet (Nov 10) — Fortune; Anthropic’s IPO set a $70–$78 range on 825M shares, with pricing expected November 18 and listing November 19 — Motley Fool.

Developer & DevOps NewsTop 5

• Check Point Patches an Exploited Zero-Day Whose Attack Chain Ends in an ESXi Wiper (Nov 13)

  BleepingComputerCheck Point advisory

  CVE-2026-123039 is a local privilege escalation in the Gaia OS DynamicCLI IPC interface: the dynamic_server daemon runs as root, listens on a world-writable /tmp/dynamic_socket, and never authenticates connecting processes — so any authenticated local user can send a command and have it execute as root. Check Point observed active exploitation against “a couple of dozen customers” since late October, and the full chain is ugly: PHP2Shell flaws on the Mobile Access portal, root via the zero-day, TSGA backdoor and TSProxy malware (previously seen on Ivanti boxes), then a pivot to a VMware ESXi host with a destructive wiper. Emergency hotfixes are out; if you can’t patch, stop the dynamic_server process and block its restart. The takeaway: your firewall is a host with local users — give it the same credential hygiene as your servers.

• OpenOrange Runs Your Cloudflare Workers and Durable Objects on Any Cloud (Nov 12)

  GitHubDocs

  Rivet’s Apache-2.0 runtime executes existing Workers projects on AWS, GCP, Azure, Hetzner or your own boxes with no code changes: wrangler config stays, orange dev replaces wrangler dev, each Durable Object becomes a Rivet Actor with its own SQLite database, and state lives in S3. orange migrate cuts traffic over while each object copies itself — zero-downtime, with rollback. The pitch is the pricing table: Durable Object compute at $0.0094 vs Cloudflare’s $0.045 per GB-hour (4.8×), storage 8.7× cheaper, and the 128 MB memory and 30-second CPU caps replaced by your hardware’s limits. It’s a Node.js reimplementation, not workerd, and the per-binding conformance pages tell you exactly what bends — worth an afternoon of testing if your Workers bill is growing faster than your traffic.

• Trend Micro Posts a 20-CVE Emergency Bulletin for Apex One (Nov 13)

  Trend Micro bulletin

  The November 13 bulletin for Apex One and Apex One as a Service on Windows spans CVE-2026-111773 through CVE-2026-111790 plus CVE-2026-109618 and CVE-2026-109619 — twenty CVEs in one drop, which almost never means nothing interesting in the set. The bulletin index doesn’t itemize severity, which is itself a reason to patch rather than triage: endpoint agents update through the management console, so this is a console-and-wait job. If Apex One is in your fleet, queue it today and check the per-CVE notes as vendors unpack them.

• FreeBSD bhyve Gets a Working Live-Migration Prototype (Nov 13)

  gyptazy.comHN, 86 points

  The WIP RFC demonstrates a running amd64 guest moving between two FreeBSD 15.1 hosts over TCP: pre-copy with dirty-page tracking added to the vmm kernel module, a migration protocol in bhyve and bhyvectl, and a stop-and-copy fallback — measured at roughly 138–171 ms of downtime for a slowly-dirtying 512 MiB guest. It’s honest about the gaps: amd64-only, built on experimental BHYVE_SNAPSHOT support, unauthenticated TCP transport, and PCI passthrough not migratable. The driver is Sylve, the Proxmox-like virtualization layer being built for FreeBSD, which needs migration before clustered operations are practical.

• FBI: North Korean Hackers Stole $400M in Crypto Using Fake Video Calls (Nov 13)

  BBCHN, 97 points

  The FBI attributes a $400M cryptocurrency theft to North Korean-linked hackers who staged fake job-interview video calls — complete with deepfaked colleagues — to talk targets into running attacker-supplied software during the call. The playbook keeps working because the hiring process is a high-trust channel nobody treats as an attack surface. Practical rules for your team: never run anything an interviewer sends, keep crypto wallets and work machines in separate browser profiles, and treat “camera fix” requests on any call the way you’d treat an unexpected email attachment.

Also tracked: Microsoft 365’s November 12 outage stretched to roughly 25 hours, and The Register’s post-mortem reads as a case study in single-vendor dependence — The Register; CISA added two actively exploited flaws to its KEV catalog on November 13, including an UnrealIRCd delimiter-neutralization bug, CVE-2026-114713 — CISA.

Self-Hosting & HomelabTop 4

• Immich 3.4 Ships JPEG XL, Mobile Tags, OCR-Triggered Workflows — and a Batch of Security Fixes (Nov 10)

  Immich blogLinuxiacBitdoze guide

  The release adds JPEG XL decoding on mobile and JXL as a server-side storage target, tags finally editable from the phone, and a workflow combo that automates the boring parts: an “Asset OCR Extraction” trigger plus an OCR text filter and new EXIF present/missing matchers, so receipts can auto-file into an album by keyword. The quiet headline is the security column — sixteen fixes including a CSP that drops unsafe-inline, shared-link visibility corrections, and the server no longer following symlinks. If you run Immich, this upgrade is not optional; our JPEG XL Docker Compose guide covers the storage-format trade-offs before you flip it on.

• Reverse-Engineering a Coway Air Purifier Into a Local Home Assistant Device (Nov 11)

  scottjg.comcoway-local on GitHubHN, 730 points

  The recipe: a Raspberry Pi access point running mitmproxy, a purifier that fetches its root CA certificate over plain HTTP, and a swapped certificate — after which the whole protocol is readable. The result is coway-local, a Home Assistant integration that pairs the fan directly (tested on the AP-1022K) with Web Bluetooth provisioning, disconnecting it from Coway’s cloud entirely. One line in the write-up is the real 2026 story: an LLM stood up the whole MitM environment unattended, in minutes. The IoT conclusion generalizes — your appliance vendors are still shipping TLS-less provisioning, and the tooling to prove it is now a weekend project.

• Unraid 7.4.0 Adds Multi-Network Docker Templates and Container Memory Limits (this week)

  selfh.st weekly

  Per this week’s Self-Host Weekly, Unraid’s 7.4.0 release finally brings the two Docker ergonomics users have requested for years: container templates that support multiple custom networks, and fields for memory limits per container. For arrays running dozens of containers, that closes the gap that forced most users into hand-edited templates and compose workarounds. If you’ve been holding a 7.3.x fleet, this is the release to test on the bench first — new Docker networking paths deserve a dry run before the production array.

• Lonewolf 0.3: a Rust XMPP Server That Can Now Federate (Nov 13)

  Release notesHN, 136 points

  The Apache-2.0, single-binary XMPP server reached the milestone that matters for a personal-domain deployment: server-to-server federation, on by default when your host has a certificate and public DNS, authenticating peers by certificate only (SASL EXTERNAL — no Dialback). Version 0.3 adds direct TLS from the first byte (XEP-0368), single shared connections between servers (XEP-0288), limits negotiation (XEP-0478), private XML storage for desktop clients, and opt-in SCRAM-SHA-512 — with the documented caveat that new credential storage breaks rollback to 0.2.0. Still pre-1.0 and single-node, so treat it as a self-hosted messaging lab, not a replacement for your Prosody box.

Also tracked in this week’s Self-Host Weekly: Vacuula, a custom server implementation for Neato robot vacuums after the cloud shutdown; plMail, a self-hosted Gmail-style webmail client with calendar side panel; and Home Assistant’s Connect AUX-2, a box for making non-smart devices smart.

Trending GitHub RepositoriesTop 10, last 7 days

Also tracked: the trending page is carrying a fresh star-farm cluster — ten-plus same-day “Blender AI copilot” repos with near-identical blurbs at 195–205★ and 3–5 forks each, plus cracked-software “desktop setup” repos with zero forks — verify before you star.

Hacker News Top Stories

1. FAA issues national ground stop — lifted 4.5 hours later(1,475 points, 1,136 comments)

   NBC Newsdiscussion

   A communications issue at multiple air route traffic control centers grounded every US departure Friday evening; the stop lifted at 0119Z. The thread is a live case study in cascading failures — Amtrak’s booking system buckled under diverted passengers, the National Weather Service’s radar site wobbled, and community-built stopgaps (a live ground-stop map, streamed ATC audio) appeared within hours.

2. LibreOffice actually works 365 days a year(863 points, 264 comments)

   LibreOffice on Xdiscussion

   The official account timed a shot at Microsoft’s outage week, and the thread became the quarter’s migration-war thread: what breaks moving off Office, and what doesn’t.

3. Doomsday: Friday, 13 November, A.D. 2026 (1960)(470 points, 323 comments)

   Sciencediscussion

   A 1960 Science paper resurfaced on the exact date it discusses — the Doomsday argument’s birthday, and a pleasantly nerdy Friday-the-13th read.

4. AI unlocks Gödel’s notebooks, said to contain hundreds of proved theorems(369 points, 96 comments)

   The Guardiandiscussion

   Machine transcription plus mathematicians are working through Gödel’s Nachlass; the thread debates how many of the “proved theorems” will survive review.

5. It Takes 16 Clicks for a Student to Open a PowerPoint on an iPad(333 points, 164 comments)

   r/Teachersdiscussion

   A teacher counts the taps in a managed-iPad classroom workflow; every enterprise admin who has shipped an MDM-mandated flow will recognize the failure mode.

6. $11.4M in Nvidia hardware vanishes during shipment from CA to TX(332 points, 184 comments)

   FreightWavesdiscussion

   A truckload of GPUs disappears in transit; the thread covers cargo theft targeting AI hardware and why high-value freight now travels like cash.

Also tracked: “Why Zig over C for Systems Programming” (216 points) — mtsoukalos.eu | discussion.

Reddit HighlightsTop 5

• r/Office365 — Summary of the 12/Nov Exchange Online outage (MO1550821 and EX1550543): what broke and what Microsoft has said so far

  Thread

  The best community post-mortem of the 25-hour outage: servers failing health checks in bulk, Defender and friends down with the same backend, and the status-page gaps admins filled themselves.

• r/sysadmin — FAA just issued a nationwide air traffic ground stoppage

  Thread

  Admins live-posting the NOTAM and the cascading failures, from ATC comms to travel systems buckling under diverted load.

• r/sysadmin — Less than 24 hours after rolling out its new SMART AI tool nationwide, the FAA hits a communications-issue ground stop

  Thread

  Unverified finger-pointing at the FAA’s fresh AI rollout; the FAA attributes the stop to communications issues, so read it as speculation — but note how fast the correlation narrative forms.

• r/immich — Security release — update now

  Thread

  Community thread on 3.4.0’s security batch (CSP without unsafe-inline , shared-link fixes); if your Immich still runs 3.3.x, this is the nudge.

• r/selfhosted — New Project Megathread — Week of 12 Nov 2026

  Thread

  The weekly haul of young self-hosted tools before they hit the front page.

Also tracked: the discussion under the 2026 Self-Host User Survey results — Portainer’s slide toward Dockhand and Forgejo overtaking Gitea are the running arguments — Thread.