Top line

Chrome 157 fixes 213 security bugs, and Edge is still catching up

Google pushed Chrome 157 to the desktop Stable channel at 2:38 PM CT Tuesday: 157.0.8103.38 on Linux and .38/.39 on Windows and Mac. The release fixes 213 security bugs, including 7 rated Critical (in Dawn, ANGLE, WebGL, Prerender, Geometry and Core) and 77 rated High. One of the Critical Prerender bugs is credited to Anthropic's Xinyang Ge working with Claude, and several High fixes are credited to OpenAI's Codex Security. Google reports no exploitation. Microsoft's Edge security notes for Nov. 3 say it is aware of the Chromium fixes and working on an update. Edge Stable is still 156.0.4314.58.

Why it matters: Seven Critical browser bugs in one release is a lot to leave open. Push Chrome 157 now, and watch for Edge's matching build instead of assuming it already shipped.

Sources: Chrome Releases · Edge security release notes

CISA lists an exploited WordPress core flaw, with a Nov. 6 deadline

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov. 3. It's a race condition in WordPress core: during a core upgrade, predictable staging paths that the web can reach let an unauthenticated attacker run code. Federal agencies have until Nov. 6 to fix it, and CISA also asks for forensic triage. WordPress 7.1.4, released Oct. 28, contains the fix. Versions 4.7.0 through 7.1.3 are affected, per Wordfence.

Why it matters: Sites that upgrade themselves are exposed during the upgrade itself. Confirm every WordPress install you run or host is on 7.1.4, and check the ones that upgraded recently for signs of compromise.

Sources: CISA KEV catalog · WordPress 7.1.4

GitHub's Git, API, PR and Actions services were down for two hours before dawn

GitHub declared a major incident from 3:49 to 5:50 AM CT Wednesday that hit Git operations, API requests, Issues, Pull Requests and Actions. GitHub says a root-cause analysis will follow. Cursor also reported slow GitHub clones Tuesday afternoon.

Why it matters: Overnight CI runs, scheduled Actions and agent jobs that push to GitHub may have failed or half-run. Check them before you trust this morning's green checks.

Sources: GitHub incident · GitHub status

Claude admins can now pre-connect workplace apps for their whole organization

Anthropic's Enterprise-managed auth lets Team and Enterprise admins authorize a connector once, and members get it on their first login, with no consent screen. The identity-provider version, Okta for now, is generally available. A beta version issued by Claude itself needs no SSO: the connector trusts an issuer URL unique to your organization, and users are matched by email. Fourteen connectors support that beta, including Atlassian, Datadog, Linear, Notion, PagerDuty and Supabase. The Claude-issued mode checks only organization membership, not SSO or MFA, and granted access lasts until it expires, so Anthropic says to remove departing users from each service before their email is reused.

Why it matters: This removes per-user OAuth friction. It also moves offboarding risk into your connector list, so pilot it with one role first.

Sources: Claude Help Center · @ClaudeDevs post

What to do

  • Roll out Chrome 157 and track Edge's matching security build. Chrome Releases
  • Patch WordPress to 7.1.4 by Nov. 6 and review sites that auto-upgraded. WordPress 7.1.4
  • Re-run CI and scheduled jobs that ran between 3:49 and 5:50 AM CT. GitHub incident
  • Cloudflare D1 queries that return more than 50 MB fail starting today. Cloudflare changelog

Also notable

  • Claude text watermark: Output from Mythos 5, Opus 4.7 and Sonnet 4.6 now carries a watermark that adds no tokens. On Sonnet 4.6, changing temperature, top_p or top_k from the defaults may remove it. Claude docs
  • Anthropic FlashProve: Anthropic open-sourced a research prototype that proves a reply came from a specific committed model without revealing its weights. Proofs cost about 70 to 95 times the GPU time of serving the same prompts on vLLM. Anthropic research
  • Fireworks Forge: Fireworks announced an Ultrafast preview (1,500+ tokens/sec), multi-day prompt caching, a background mode for agents, higher rate limits, and EU capacity on NVIDIA hardware starting in 2027. Fireworks announcement
  • Together AI: Together now serves the Anthropic Messages API and OpenAI Responses API formats, so those apps can switch providers by changing their key, base URL and model. Together changelog
  • Open models: Tencent announced Hy4 with vision, though we couldn't yet find its weights or license. Together says Kimi K3.1 Pro weights drop today. Tencent Hunyuan post · Together post
  • Codex usage: OpenAI's Tibo Sottiaux said the $500 Pro plan gives "50X" usage, replying to a claim that it was 25x. He didn't say 50x of what. This follows OpenAI's Oct. 29 doubling of Pro 100 and Pro 500 Codex allowances. Tibo's reply
  • Catch-up, EU copyright: On Nov. 3, an Advocate General at the EU's top court said chatbots that pull press articles in real time may infringe publishers' rights, while training is generally allowed. The opinion isn't binding. CJEU press release

Sources

Chrome Releases · Edge security release notes · CISA KEV catalog · WordPress 7.1.4 · GitHub incident · GitHub status · Claude Help Center · @ClaudeDevs post · Cloudflare changelog · Claude docs · Anthropic research · Fireworks announcement · Together changelog · Tencent Hunyuan post · Together post · Tibo's reply · CJEU press release