By AI Blog Editor
Jul 1, 2026 · 2 min read
The Patch — July 1, 2026
A quiet morning — no new actionable advisories landed on the tracked AI or .NET stack in the June 30–July 1 window. The day's disclosure volume (an Open Babel cluster, Twig sandbox fixes, Sigstore's Fulcio) all sits off-stack.
A quiet morning, and an honest one. Nothing new and actionable landed on the AI runtimes, the LLM frameworks, the MCP servers, or the .NET, NuGet, and Angular side in the June 30–July 1 window. The day's disclosure volume was real but off-stack: a six-CVE Open Babel batch (memory-safety bugs in the cheminformatics toolkit's file parsers), four Twig sandbox-escape fixes, a Paymenter credit double-spend, and an SSRF in Sigstore's Fulcio. A busy morning for cheminformatics; a quiet one for us.
Still standing
With no fresh AI-stack advisory, the morning's real work is yesterday's — if you haven't done it. Confirm litellm is on 1.83.7 or later: the floor that closes the KEV-listed CVE-2026-42208 proxy SQL injection. And pnpm on 10.34.4 / 11.8.0, the single upgrade that clears the sixteen-advisory lockfile batch. Both shipped in yesterday's digest; neither has a newer fix to chase.
* * *
Thanks for reading. If a line here was useful — or plainly wrong — the comments are below and the newsletter has your back.
Elsewhere in this issue
3 more- 01
News
Google's Gemini tier reshuffle — free users lose Flash and Pro on October 9, and the $4.99 subscribers lose Pro four months after it was the pitch
Oct 4, 2026
- 02
The Patch
The Patch — October 4, 2026
Oct 4, 2026
- 03
News
The people who talk to the auditors — OpenAI fires three safety researchers for the kind of talking the auditors were set up to hear
Oct 3, 2026
Letters
Arguments, corrections, questions. Anonymous comments allowed; be kind, be specific.