GPT-6.1 Terra lands in Copilot and Bedrock

Plus a Rust port of tsc, a PHP bug on CISA's KEV list and Microsoft's buyout offer

The main thing

Your coding agent has a new model to pick from this week. If you already use Copilot or Bedrock, you can probably try GPT-6.1 Terra today.

OpenAI's launch describes Terra as a fast, efficient model that combines detailed visual reasoning with computer use. Simon Willison pointed out that those are the two strengths OpenAI chose to lead with. GitHub and AWS shipped it on the same day:

• GitHub Copilot: generally available. It is built for everyday agentic coding and terminal work, at a lower cost than GPT-6.1 Sol.
• Amazon Bedrock: generally available. AWS calls it a balance of capability, speed and cost for everyday workloads.
• Pricing, benchmarks, limits: the GitHub and AWS announcements do not list them. Read the launch post before you change any defaults.

The Hacker News discussion is split. One commenter read OpenAI's charts as Terra matching GPT-6-Astra at a fraction of the cost. Another pointed to Terminal Bench 4.0, where they say Terra XHigh costs more than Sol Low and still scores lower.

A third commenter called Terra "a weird middle child" between Luna, the small model that got much better, and Sol, the large model that got much cheaper. One commenter said people keep asking OpenAI for "a mode that's as good as Opus 5.5" and OpenAI released this instead, and two others brought up Astra 6.1.

What to do today: If you have Copilot or Bedrock, run Terra on one real task from your backlog next to the model you use now. Compare both the result and the bill. Don't switch your default just because of a benchmark chart, including the ones commenters are arguing over.

Quick bits

tsrs, an experimental, AI-generated Rust port of the TypeScript compiler, comes from Cloudflare, VoidZero and Max Schwenk. It claims up to 8x faster checking and around 70% less memory than TypeScript 7.0, but one test against the 7.1 beta found 2.7x. It has no watch mode, and it exits with code 2 on type errors where tsc exits with 1.

CVE-2026-109618 is a PHP memory corruption bug that allows unauthenticated remote code execution, and it is now in CISA's Known Exploited Vulnerabilities feed. Our source gives no affected versions or fix. Check your PHP vendor or distro advisory, and patch internet-facing PHP first.

Microsoft offered voluntary buyouts to about 60,000 employees at VP level and below in the US, Canada, India and the UK. The offer is a standard severance package. Microsoft expects an acceptance rate as low as 3% to 5%, and staff have until early December to decide.

A Cloudflare config mismatch plus an SGLang bug put other customers' data into 155 GLM-5.3 Workers AI responses (August 27 to September 9, prompts over 681,280 tokens). If you run SGLang in disaggregated prefill/decode mode yourself, Cloudflare recommends upgrading to SGLang v0.5.22 or later, which has both upstream fixes. It also says to check that each node's KV cache pool is at least as large as your context length.

Go 1.27.3 and 1.26.10 block certificates that chain to compromised eMudhra intermediates, whose weak private keys could be recovered in microseconds. This matters most on Linux, where Go uses its own verifier. If you haven't since October 19, upgrade and rebuild your Go binaries that make TLS connections.

Anthropic filed its S-1. TechCrunch reports soaring revenue and mounting losses. It also found that more than half of Anthropic's $100,000-plus customers use both the Claude Platform and a first-party app.

Copilot assisted permissions are generally available in the CLI, the Copilot app and VS Code. An LLM reviews each command, file path or URL request. Requests it rates clearly safe go ahead, and you approve the rest. In the CLI, run /permissions, then select assisted.

OpenTofu 1.13 adds convert and assumenotnull, so count and for_each resolve at plan time more often. It also removes WinRM provisioner support and changes base64gzip output, which can trigger resource updates. 1.13.2 shipped October 21 with two security fixes.

Also happening

• Websites Should Be Printable: a short @media print snippet you can copy.
• Svelte 5.57.3: fixes for a11y fallback roles and hydration.
• The Mythical Man-Month in the Age of AI: Brooks's Law, applied to agents.
• The Evolution of Agentic Harnesses: chains, graphs, then code, from LinkedIn's experience.
• Fixing Tool-Call Accuracy in vLLM: a constrained decoding flag in vLLM 0.31.
• Ollama v0.40.12: a pre-release with MLX Gemma 4 vision fixes and DFlash2 support.
• OpenAI's math and physics results: includes the claim that the Exponential Time Hypothesis is false.
• How long a DigitalOcean function stays warm: none of the author's test containers survived 20 idle minutes.
• Vercel custom monitors: alerts on one metric, or a ratio of two, from Observability query results.
• Vercel Agent validates alerts: on a webhook destination set to Critical Only, only alerts it classifies as Critical get through.
• Vercel Sandbox stdin: lets you talk to stdio MCP servers inside a sandbox.
• AWS KMS supports ML-KEM: all three FIPS 203 key specs.
• ReadyOn's four-layer EKS isolation: namespaces, node pools, security groups and a database per tenant.
• Why is it so expensive to send an email?: the author found sending over SMTP easy and getting past spam filters hard.
• Ruff 0.17.3: fixes incorrect UP032 f-string conversions.
• uv 0.13.6: new CPython builds and lower memory use on large workspaces.

Patch roundup

• PHP, CVE-2026-109619: our source gives no fixed version. Check your PHP vendor or distro advisory.
• pnpm: pnpm@12.16.0, or pnpm@11.28.9 on the 11.x line.

Pick a model, patch your PHP, and keep your coffee warmer than a DigitalOcean function.

← All issues