Moonshot shipped Kimi K3.1 Pro, its strongest open-weight-bound model yet, and three OpenAI posts lead the engineering reading this weekend: a full account of why frontier training now runs without live internet, a deep dive into the storage platform behind ChatGPT, and the general availability of the Decisions API. Anthropic donated Agent Skills to a new open foundation, and Sebastian Raschka published a complete video course on building reasoning models.
The week’s biggest security stories broke too late for the previous list and belong here: eMudhra’s eight intermediate CA keys — one of them was the number 4 — forced emergency distrust across browsers and ended its global TLS business, while Railway disclosed an intrusion that may have exposed secrets in roughly 100,000 workspaces, apparently hunting AI provider API keys. Outside AI, the PHP2Shell saga and a Brotli decoder bug top the patch list, with the first round of iPhone Duo reviews landing.
From the labs
- Introducing Kimi K3.1 Pro — Moonshot AI (+ Simon Willison, The Next Web)
- Securing our frontier model training environment — OpenAI
- Build more responsive apps with the Decisions API — OpenAI
- Rapidly scaling online storage to serve over 1 billion ChatGPT users (Part II) — OpenAI
- Donating Agent Skills to the Agentic AI Foundation — Anthropic (+ Simon Willison)
Worth your time
- Build Your Own Reasoning Model: A Full Video Course — Sebastian Raschka
Security
- eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable — The Hacker News (+ eMudhra statement, The Register)
- Preliminary Report: Oct 21st Security Incident — Railway (+ The Hacker News, TechCrunch)
Beyond AI
- PHP-ocalypse: How two critical web bugs almost broke the internet — Zack Whittaker (+ CISA alert)
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software — The Hacker News
- The iPhone Duo — John Gruber (+ The Verge review)