CSS-Tricks lives once more, October security issues, Bootstrap 6 Alpha, and more | Front End News #117

CSS-Tricks lives once more, October security issues, Bootstrap 6 Alpha, and more

— Front End News #117 | 2 November 2026 —
Author: Adrian Sandu

The community can breathe easier, as Geoff Graham becomes the owner of CSS-Tricks and pledges to continue running and growing the project.

In other news, October saw several serious security incidents. We get a preview of Bootstrap 6 Alpha and TypeScript 7.1 Beta, along with other interesting releases. Two new resource categories, a collection of opinions on the current state of developer education, and three more names in the Developer Creator Club.

I am currently looking for new opportunities, with a focus on the front-of-the-frontend, either in general or on the Shopware platform in particular. You can contact me on my website.

CSS-Tricks lives once more

Last month, we were decrying the limbo CSS-Tricks got stuck in. This month we rejoice, for CSS-Tricks lives again, and this is great news for the community.

Geoff Graham announced that he is the new owner of CSS-Tricks. He assured everyone he "got the keys to the castle, so to speak," and that managing this project is his new full-time job. He intends to continue growing and developing the site, publish new articles, and continue supporting the community.

Congratulations, Geoff! Long live CSS-Tricks!

Hacktober, but not as we expected

This October saw a cluster of major security issues, all within a span of several days. Companies and specialists scrambled to secure the infrastructure that powers so much of modern life. Here are four significant cases, along with an article explaining each.

PHP2Shell

PHP2Shell exposed two critical vulnerabilities in PHP that could let attackers run code on affected servers without logging in. The PHP Foundation explains what went wrong, why fixing it took so long, and how it is strengthening PHP’s security work.

eMudhra key disclosure

HTTPS depends on certificate authorities to vouch for website identities. eMudhra generated certificate-signing keys so weak that anyone could recover them and issue fraudulent certificates for domains they didn’t control. The incident forced browsers, operating systems, and other software to stop trusting the affected certificates. The Go team’s account explains the wider threat through its own emergency response.

LiteLLM hijack

LiteLLM provides a Python library and proxy for connecting applications to large language models. Attackers compromised its release process and published version 1.107.0, which contained malware that stole credentials and enabled remote code execution. The team’s investigation explains how exposed credentials led to a malicious release.

GitLab Critical Patch Release

GitLab released security patches addressing several vulnerabilities, including a critical flaw that could let attackers run code on a GitLab server without logging in. If you manage your own GitLab installation, check the affected versions and update. GitLab.com was already patched.

💻 Browser News

The Browser Company decided to sunset the Arc browser and channel their efforts into a new project, named Dia. They claim Dia is built from the ground up with security and privacy in mind. I am looking forward to seeing where this is heading.

Web Platform Updates

For this edition, we have only the summary of the September updates:

Chrome

The usual “New in Chrome” blog posts seem to be lagging behind the releases. At the time of writing, the Chrome Platform Status page shows the current stable version as 157. Yet the latest article I could find covers Chrome 154, which we included in the previous issue. However, there is a new post on the latest DevTools updates.

Firefox

The Firefox team is running an amusing promotional campaign featuring a lot of the "classic" Internet memes, like the Numa-Numa kid or the Overly Attached Girlfriend.

They also officially launched the Enterprise version of Firefox, which includes a self-hosted management console. This is meant for organizations that need strict control to meet security and compliance requirements.

On top of that, there are the normal releases.

Firefox 158 implements support for the JPEG XL image format. Scrolling is now smoother and more precise, as scroll position values are no longer rounded. And saving a page as PDF creates more accessible documents.

Firefox 159 brings support for scroll-driven animations, and you can access your passwords directly in the sidebar.

WebKit

Apple launched iPhone Duo and Safari 27.1 together. As expected, several features address the specific situation of this kind of device. The interesting bits are experimental, sit under feature flags, and are named the Device Posture API and the Viewport Segments API.

Safari 27.2 followed swiftly after the previous release. It brought refinements for Customizable Selects, a change in Grid Lanes (the flow-tolerance property was renamed to fit-tolerance), and 20 bug fixes.

Wolvic

Although Wolvic is currently in maintenance mode, updates are still coming for users.

🚀 Web Performance

Harry Roberts maintains his Web-Perf Wednesday writing streak with four more articles. That's some awesome levels of work and consistency! You're a wizard, Harry!

📡 The Release Radar

Node.js is hitting a major milestone, as version 26 enters Long Term Support as “Lithium”, with updates planned through April 2029. Version 26.13.0 marks that transition without adding functional changes over 26.12.1. If you haven’t updated recently, check the October 21 security advisory and upgrade your supported release line.

🛠️ Front End Resources

I am introducing two new categories of resources: courses and podcasts. For now, I will focus on free courses, and a good start is the set put together by the Web.dev team:

Podcasts can be a great source of knowledge in a format you can consume when reading isn't an option. I aim to provide a broad selection with a wide focus across the industry.

There's more where that came from. Explore the rest of the Front End Resource collection.

📑 Interesting articles

I want to highlight some articles (and the occasional video) where some creators discuss the current state of the industry in general and developer education in particular:

🏆 The Developer Creator Club

Developer education is not in the bright spot it used to be. Creators find it harder and harder to make this activity sustainable. But we, the community, can help them bypass this phase.

Important note: I am listing these products to help more people discover them. I have not purchased or reviewed them, so I cannot personally vouch for their quality, value, or results. Please evaluate each product based on the information provided by its creator and the creator's established work and reputation.

Andy Bell

Andy is a designer, front-end developer, and educator. His teaching goes beyond individual CSS features, covering the planning, communication, and practical decisions involved in building maintainable websites. He also co-created Every Layout with Heydon Pickering.

You can also check out other premium courses on Piccalilli.

Heydon Pickering

Heydon is a designer, writer, and accessibility educator who explores how everyday interface patterns can work for more people. He wrote Inclusive Components and co-created Every Layout with Andy Bell, bringing together inclusive design and resilient CSS layouts.

Dr. Axel Rauschmayer

Axel is an author and educator known for the 2ality blog and his books about JavaScript and TypeScript. He recently took his blog and free online books offline temporarily because AI crawler traffic became unaffordable and book sales collapsed. His books remain available to purchase through Payhip.

Wrapping things up

Ukraine is still suffering from the Russian invasion. To find ways to help, please read Smashing Magazine's article We All Are Ukraine 🇺🇦 or contact your trusted charity.

If you enjoyed this newsletter, there are a couple of ways to support it:

Each of these helps me out, and I would appreciate your consideration.

That's all I have for this issue. Have a great and productive week, keep yourselves safe, and spend as much time as possible with your loved ones. I will see you again next time!

Credits

Phoenix artwork image by Gordon Johnson from Pixabay