Next.js just had a two-CVE week — and Claude started talking to lab robots

Two stories dominated this week: Next.js shipped emergency patches for two RCE-capable bugs, and Anthropic opened a standard that lets AI agents drive physical lab equipment. Everything in between is worth a scan too.

Next.js & the browser

Next.js patched two critical, unauthenticated RCE vulnerabilities in a rushed release: CVE-2026-75604 hits self-hosted Windows servers on both routers, and a second flaw lets a crafted AVIF image trigger remote code execution during image optimization. If you self-host — Vercel is unaffected — update to 16.3.3 or 15.5.24 now.

Chrome 152 shipped with a batch of things worth knowing about: Connection Allowlists for locking down outbound requests from a page, new ::backdrop, ::scroll-marker, and ::view-transition pseudo-element support, a window-drag CSS property for installed web apps, and relative alpha color syntax.

AI

Alibaba open-sourced Qwen3.8-Flash-Next, a 125B-parameter multimodal MoE model that only activates 6B parameters per token and previews the coming Qwen4 architecture — full writeup here. Native 262K context, extendable to 1M, and priced aggressively against Anthropic and DeepSeek.

Anthropic previewed the Model Hardware Standard, a shared spec that lets AI agents operate lab and factory hardware — microscopes, liquid handlers, robotic arms — through one interface instead of vendor-specific code. Think MCP, but for machines that can burn you: details from Anthropic.

Tools

Claude Code got noticeably leaner this week: the native Linux install dropped from ~340MB to ~75MB via zstd compression, startup no longer blocks on sandbox and MCP bring-up, and /cost, /usage, and /tasks now show real token detail. Full changelog.

None of this is flashy on its own, but the pattern is: infrastructure is quietly catching up to how fast everyone ships. A critical Next.js RCE patched within a day of disclosure, a browser shipping primitives that used to need a JS library, and an agent framework reaching past the browser into physical hardware — that's the week, not any single headline.

The unglamorous fixes — patch cycles, binary size, pseudo-elements — are what let the glamorous stuff actually ship.