Safari Technology Preview Release 118 has been released for macOS Big Sur and macOS Catalina. Download it here, or update your existing version in the Software Update pane of macOS' System Preferences. Highlights from the release:

• Web Inspector: An experimental Font details sidebar panel that displays data about the selected node's presently used font and support for intercepting and overriding network requests 
• Definite and Indefinite Sizes in Flexbox
• Enabling of “at” methods
• WebAPI now allows blob URLs with fragments 

For a more detailed list of changes, check out the release notes.

The FBI is probing whether the Russian hackers that targeted the SolarWinds Orion platform used software created by JetBrains, Reuters reported. JetBrains' TeamCity is used to construct other software and has SolarWinds as a customer. JetBrains has previously reported critical bugs in its TeamCity software.

More:

• The New York Times reported that U.S. intelligence agencies and cybersecurity companies were also involved in the JetBrains probe.
• In a statement, JetBrains CEO Maxim Shafirov said that he is not aware of any investigation into its TeamCity product and that its product is secure if configured properly.
• JetBrains is based in the Czech Republic and has offices in Russia, the U.S., and the European Union.

This story first appeared in Inside Security. You can read the full issue here.

GitHub announced it added three new features to make GitHub faster to use over the holidays. These include:

• The ability to add videos to your issues, pull requests, and discussion comments, which is currently a public beta feature
• Markdown list auto-complete, which makes it faster to write markdown and works with all of your lists. 
• Multi-word reference searching, which makes it faster to find what you're looking for in comments.

You can leave feedback on these new features here.

Chronosphere's cloud-native monitoring product is now generally available. The new tool is designed to make it possible for users to store and retrieve monitoring data from cloud-native environments while also helping them control spending as their data grows.

More:

• Chronosphere's new tool is powered by the open-source metrics engine M3 that the company's founder built while working at Uber. 
• The product is also offered as a hosted service while still being 100% compatible with cloud-native standards like Prometheus, PromQL, and Grafana Dashboards. 
• The company announced it raised $43.4M in its Series B funding round. Previous investors Greylock, Lux Capital, and venture capitalist Lee Fixel participated in the round, as did General Atlantic.

In case you missed it, the second version of popular object-oriented programming book, "99 Bottles of OOP: A Practical Guide to Object-Oriented Design" by Sandi Metz, Katrina Owen, and TJ Stankus is now available. The book now covers PHP, in addition to JavaScript and Ruby. 

More:

• This second version contains three new chapters and consists of "separate books that are technically identical, but use different programming languages for the examples."
• You can purchase it here for $39. It is only available in digital form.
• You can read excerpts from the book here.

Attackers could abuse an untrusted deserialization vulnerability in the web app developer tool Zend Framework and its successor Laminas Project to carry out a remote code execution (RCE) attack on PHP-based websites. Security researcher Ling Yizhou, who discovered the flaw, posted proof-of-concept attacks on GitHub.  

More:

• The vulnerability is located in the destructor of the Stream class, which is a PHP magic method.
• Matthew Weier O’Phinney, Zend product owner and principal engineer, disputed the researcher's findings, telling Threatpost that the web application developer has to write insecure code before the issue can be exploited.
• Zend has issued a fix for the problem.
• The Zend Framework has been installed more than 570 million times.

This story first appeared in Inside Security. You can read the full issue here.

QUICK HITS:

• Laird Superfood releases its first ever functional coffee with Vitamin D. Elevate your coffee today!*
• Bootstrap reveals it will be adding more than 60 icons in its next release this year.
• "Automate the Boring Stuff with Python" is currently free to sign up for when you use the code JAN2021FREE.
• Linus Torvalds' dad, a Member of the European Parliament (MEP), says the National Security Agency (NSA) wanted backdoor access in Linux, a piece of news that was published over a month ago but is only now capturing attention.
• Automation is your friend. See how Smart Transfers by M1 Finance takes the work out of money management so you can reach your goals more easily.*

*This is a sponsored post.