Tech radar: week 4 of 2026
19–25 Jan 2026
In the week of 19–25 Jan 2026, 13 notable open-source releases shipped (including vLLM v0.14.1, MCP Python SDK v1.26.0, React Router v7.13.0), CISA added 6 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “ICE using Palantir tool that feeds on Medicaid data” (1475 points).
Releases worth knowing about
AI & machine learning
This is a patch release on top of v0.14.0 to address a few security and memory leak fixes.mentions security
ci: add all-green job to pull-request-checks workflow by @maxisbey in https://github.com/modelcontextprotocol/python-sdk/pull/1929
llama-index-core [0.14.13]mentions security
<img width="4502" height="2222" alt="An image of Ollama building rapidly on the computer. Build with Ollama!" src="https://github.com/user-attachments
PyTorch 2.10.0 Release Notesmentions security
Web frameworks
See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.mdv7130
- feat: export parseCss from svelte/compiler (17496)
[12.x] Fix missing variable reassignment by @nunomaduro in https://github.com/laravel/framework/pull/58376
Testing & security tools
📣 Playwright CLI+SKILLs 📣
Languages & runtimes
<a id="1.93.0-Language"</a
\[8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) 60959mentions security
Mobile & desktop
Added support for WebSocket authentication through the login event on webContents. 49065 <sup(Also in 40)</sup
Cloud & DevOps
Today, we are excited to share the 7.3.0 stable release 🎉mentions security
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 6.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2024-37079 | Broadcom VMware vCenter Server | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 2026-01-23 |
| CVE-2026-20045 | Cisco Unified Communications Manager | Cisco Unified Communications Products Code Injection Vulnerability | 2026-01-21 |
| CVE-2025-54313 | Prettier eslint-config-prettier | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 2026-01-22 |
| CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 2026-01-22 |
| CVE-2025-34026 | Versa Concerto | Versa Concerto Improper Authentication Vulnerability | 2026-01-22 |
| CVE-2025-31125 | Vite Vitejs | Vite Vitejs Improper Access Control Vulnerability | 2026-01-22 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01ICE using Palantir tool that feeds on Medicaid data1475 points · 969 comments · 2026-01-25
- 02Show HN: isometric.nyc – giant isometric pixel art map of NYC1325 points · 241 comments · 2026-01-22
- 03Bugs Apple loves1122 points · 537 comments · 2026-01-23
- 04Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops1040 points · 662 comments · 2026-01-23
- 05We will ban you and ridicule you in public if you waste our time on crap reports949 points · 617 comments · 2026-01-22
- 06GPTZero finds 100 new hallucinations in NeurIPS 2025 accepted papers937 points · 507 comments · 2026-01-22
- 07First, make me care813 points · 249 comments · 2026-01-25
- 08European Alternatives810 points · 512 comments · 2026-01-23
- 09Danish pension fund divesting US Treasuries776 points · 806 comments · 2026-01-20
- 10EU–INC – A new pan-European legal entity765 points · 726 comments · 2026-01-21
- 11I was banned from Claude for scaffolding a Claude.md file?749 points · 638 comments · 2026-01-22
- 12Qwen3-TTS family is now open sourced: Voice design, clone, and generation744 points · 225 comments · 2026-01-22
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.