Roundup
What Is the Hotel Core System "NEHOPS"? The Jtas Cleaning Integration, Explained
AIJapanese Companies
NEC's hotel core system NEHOPS—covering booking, front desk and accounting—deepened its integration with Edeyans' room-cleaning system Jtas in June 2026. Order items and requests now pass in real time instead of once a day, and free memos are parsed by AI into cleaning instructions. We explain what NEHOPS is, what it automates, and what it means for hotels and guests.
2026.06.1529 views
News
Claude Fable 5 is back after 19 days as US export controls lift
Global CompaniesAILawsuits & Regulation
Three days after launch, Anthropic disabled Claude Fable 5 and Mythos 5 worldwide to comply with a US Commerce Department export-control directive targeting foreign nationals. Users and companies in Japan are caught in the cutoff too.
2026.06.1354 views
News
Eight Sandbox-Escape Flaws Hit vm2, Three Rated Max Severity — Patch to 3.11.4 Now (CVE-2026-47131)
DevelopmentSecurityAI
vm2, the Node.js library used to run untrusted code in a sandbox, has eight new escape flaws (three rated the maximum 10.0) that let attackers take over the host. Fixed in vm2 3.11.4 — but vm2 is discontinued, so the real fix is migrating to isolated-vm or container isolation. Run npm ls vm2 to check, and act fast if you run AI-generated code.
2026.06.1360 views
Column
Rebuilding Kakaku.com's 30-Year-Old Code With 71 AI Agents
AIJapanese CompaniesDevelopment
Kakaku.com is rebuilding its 30-year-old, 9.6M-line system with 71 AI agents on Python and FastAPI. I agree with the stack, but ask why the tied candidates lost, and the cost of over-trusting AI.
2026.06.1065 views
News
Claude Fable 5 Goes Public: Why Engineers Cheered, Then Revolted
Global CompaniesAI
On June 9 Anthropic released Claude Fable 5, the safety-wrapped public version of Mythos—the 'too dangerous' top model that governments and Japan's Diet had fought over for a month. Engineers cheered an 80.3% SWE-Bench Pro score, then revolted over a term that silently degrades performance and over-eager censorship.
2026.06.1046 views
News
Apache HTTP Server HTTP/2 Bomb: Affected Versions and the 2.4.68 Fix
InfrastructureSecurityAI
A flaw called the 'HTTP/2 Bomb' (CVE-2026-49975) lets even a single home PC take Apache and other major web servers offline in seconds. OpenAI's AI 'Codex' found it before humans did, a proof-of-concept is public, and Shodan shows 880,000+ servers exposed. Apache fixed it in 2.4.68, released June 8. Here are the affected versions and what to update now.
2026.06.09221 views
News
LiteLLM CVE-2026-42271: 1.83.7 isn't enough, upgrade to 1.84.0+
AISecurityDevelopment
LiteLLM, the popular gateway fronting 100+ AI services, has a server-takeover flaw (CVE-2026-42271). Chained with a Starlette bug it enables unauthenticated remote code execution, exposing every stored API key. Patch to 1.83.7 now.
2026.06.09105 views
News
AI Component Guardrails AI Hit by a Poisoned Package: CVE-2026-45758, TeamPCP's New Target
AISecurity
The PyPI distribution of Guardrails AI, a popular OSS component for validating LLM I/O, was laced with a credential-stealing poisoned version 0.10.1. Tracked as CVE-2026-45758 (CVSS 9.6), it is part of a chain of supply-chain attacks by TeamPCP that spread 400+ poisoned versions across 170+ packages including TanStack and Mistral AI, expanding into AI development. Here are the safe versions and the steps to check and respond.
2026.06.0676 views
News
Flaw in Amazon's AI dev tool Kiro, CVE-2026-10591: open a folder, run code
AISecurityDevelopment
Amazon Kiro flaw CVE-2026-10591 (CVSS 8.8): the AI's file-write tool can write to .vscode/tasks.json, auto-running an attacker's command when the folder opens. Prompt injection is the trigger. Update to Kiro 0.11 or later.
2026.06.0362 views
News
New Langroid server-takeover flaw CVE-2026-54769 (CVSS 10.0): AI-written code gives unauth RCE — update to 0.65.2
AISecurityDevelopment
Langroid's SQLChatAgent runs AI-generated SQL unchecked (CVE-2026-25879, CVSS 9.8): prompt injection can reach DB-host RCE. Update to v0.63.0; least privilege.
2026.06.0268 views
News
vLLM Ignores --trust-remote-code=False: Third RCE, CVE-2026-4944
AISecurityDevelopment
vLLM silently overrides your --trust-remote-code=False via hardcoded True in two model files (nemotron_vl.py, kimi_k25.py). Malicious HuggingFace repos can trigger RCE. Fixed in vLLM 0.18.0. The third bypass in the series.
2026.05.2988 views
News
Zed Editor RCE Fix (CVE-2026-44461–44466): Update to 0.229.0 — Opening a Malicious Repo Runs Code on Your Machine
DevelopmentAISecurity
Opening a malicious repo in the Zed editor runs arbitrary code on your machine. CVE-2026-44466 (CVSS 8.6) plus 3 more RCEs hit versions before 0.227.1/0.229.0. The fix is 0.229.0 — update now.
2026.05.29137 views
