Digest · 21 stories · 44 sources

2026-06-13

Updated

Suggest a story

Top stories

  1. AI confirmed Anthropic suspends Fable 5 and Mythos 5 after US export directive Anthropic received a US government export control directive at 17:21 ET on 2026-06-12 to suspend all access to Fable 5 and Mythos 5 by any foreign national, inside or outside the United States, including foreign-national Anthropic employees. Anthropic disabled both models for all customers to comply; access to all other Anthropic models is unaffected. Anthropic states the letter gave no specific national security detail and that its understanding is the government is concerned with a method of jailbreaking Fable 5, which it describes as narrow and non-universal and consisting of asking the model to read a codebase and fix software flaws, a capability it says is available in other models including OpenAI GPT-5.5.
  2. Security confirmed Oracle PeopleSoft CVE-2026-35273 zero-day actively exploited; CISA KEV CVE-2026-35273 (CVSS 9.8) is an unauthenticated remote vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools, classified as server-side request forgery and leading to remote code execution. It was exploited as a zero-day between 2026-05-27 and 2026-06-09, two weeks before Oracle's 2026-06-10 out-of-band advisory; Google attributes exploitation to ShinyHunters. PeopleTools 8.61 and 8.62 are affected. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-12 and ordered federal agencies to patch.
  3. Security confirmed AI agent finds 21 zero-days in FFmpeg for about $1,000 DepthFirst reports its autonomous security agent found 21 previously unknown vulnerabilities in FFmpeg at a cost of about $1,000, spanning the TS demuxer, VP9 decoder, swscale, RTP depacketizers, DASH demuxer, RTSP server, RTMP client, and the option parser. Nine carry CVE identifiers (CVE-2026-39210 through CVE-2026-39218); the remainder are fixed upstream and awaiting numbers. The most severe, DFVULN-127, is a heap buffer overflow in the AV1 RTP depacketizer where a single 183-byte packet over a network-reachable RTSP stream can redirect execution to an unauthenticated RCE primitive. Several bugs had been latent for 15 to 20 years.
  4. AI confirmed Claude Sonnet 4 and Opus 4 retire 2026-06-15 claude-sonnet-4-20250514 and claude-opus-4-20250514 are removed from the Claude API at 09:00 PT on 2026-06-15 with no grace period; requests to the retired model IDs fail immediately. Successors are claude-sonnet-4-6 and claude-opus-4-8. The Agent SDK credit split from subscription usage also takes effect 2026-06-15.
  5. Linux/Kernel developing Linux 7.1 stable expected 2026-06-14 Linus Torvalds released Linux 7.1-rc7 on 2026-06-07 and stated he expects it to be the last release candidate, with the 7.1 stable release on 2026-06-14 unless an eighth candidate is needed. The biggest area of late-cycle fixes was GPUs, followed by networking, with the rest spread across architecture, driver, filesystem, and build fixes. The cycle ran heavier than usual due to an uptick in AI-agent-generated patches.

AI

  1. AI developing Kimi K2.7-Code released as open-weight coding model Moonshot AI released Kimi K2.7-Code on 2026-06-12 as an open-weight agentic coding model under a Modified MIT license. The model card describes a Mixture-of-Experts architecture with about 1 trillion total and 32 billion activated parameters, a 256K context window, and roughly a 30 percent reduction in thinking-token usage versus Kimi K2.6. HN discussion focused on cost: commenters noted Chinese open-weight models price far below Anthropic Opus while approaching its quality for many coding tasks, and several reported evaluating a move off proprietary agents to opencode or similar harnesses with K2.7.

Agentic coding

  1. Agentic coding discussion How to set up a local coding agent on macOS A widely discussed write-up walks through running a local coding agent on macOS with local model inference. HN commenters noted that llama.cpp can fetch models directly with -hf and LLAMACACHE without a separate downloader, pointed to ollama and opencode as an alternative stack, and reported mixed speedups from multi-token-prediction draft setups on Apple Silicon.

Security

  1. Security confirmed Arch Linux AUR supply-chain attack hits more than 1,500 packages Attackers hijacked orphaned packages in the Arch User Repository (AUR) by claiming them through the standard adoption process, then modified each package's PKGBUILD build script to silently fetch and install malicious npm packages (reported as atomic-lockfile and js-digest) during installation, delivering a Linux infostealer with credential-harvesting, anti-debugging, and data-exfiltration functionality plus an optional eBPF rootkit. The affected count grew from more than 400 packages on 2026-06-11 to more than 1,500 by 2026-06-12. Arch published an official incident notice on 2026-06-12 stating it was actively tracking down malicious commits, with AUR account creation, package updates, and package adoption disrupted during cleanup; by the end of 2026-06-12 maintainers believed they had removed all known malicious commits and consider the incident under control. The official Arch binary repositories are unaffected.
  2. Security confirmed AMD denies $10,000 bounty for auto-updater RCE; CVE-2026-40677 A researcher (MrBruh) reported a remote code execution flaw in AMD's auto-update software, exploitable via a man-in-the-middle attack because the downloaded executable was validated only with a CRC32 check rather than a cryptographic signature. AMD initially closed the report as out of scope and paid no bounty; the issue was later assigned CVE-2026-40677 (CVSS 7.7) and took 124 days to patch, with the embargo ending 2026-06-09. After the write-up reached HN, AMD's bulletin acknowledged the vulnerability and credited the researcher.

Outages

  1. Outage confirmed Meta global outage on 2026-06-12 Facebook, Instagram, WhatsApp, and Messenger went down worldwide starting shortly before 10:00 ET on 2026-06-12, with Downdetector logging over 100,000 reports by 10:00 ET. Facebook was hardest hit, logging users out and blocking re-login; Instagram showed loading and "query error" failures. The outage lasted about four hours. Meta communications VP Andy Stone confirmed the disruption. A Meta spokesperson later said the technical issue was resolved as quickly as possible and apologized; Meta has not published a root cause.
  2. Outage confirmed Cloudflare Dashboard and API control-plane incident resolved Cloudflare reported Dashboard and API service issues on 2026-06-12. CDN edge serving and security features were unaffected; the impact was on the control plane. Cloudflare identified the issue and implemented a fix at 14:56 UTC, began monitoring at 15:03 UTC, and marked the incident resolved at 15:27 UTC. Cloudflare has not published a root cause. Details were gathered through aggregators and discussion because cloudflarestatus.com returns 403 from the unattended harness.

Developer tools

  1. Dev tools developing tmux 3.7-rc adds floating panes tmux published a 3.7 release candidate on 2026-06-12. The headline feature is floating panes, which sit above the tiled layout like non-modal popups, are created with a new new-pane command bound to by default, and behave like ordinary panes. Other changes include a copy-mode-line-numbers option with off, default, absolute, relative, and hybrid modes, run-shell argument expansion as #{1}, #{2}, and a -g flag for kill-session that kills all sessions in a session group.
  2. Dev tools confirmed Homebrew 6.0.1 patches the 6.0.0 rollout Homebrew shipped 6.0.1 on 2026-06-12, a bug-fix patch on the 6.0.0 major release from 2026-06-11. Changes include including the cask tap in core taps on all platforms, fixing brew bundle kwargs handling for taps and installing taps before packages, and simplifying Bubblewrap sandbox handling for Linux builds.

Languages and runtimes

  1. Languages confirmed Spring Boot 4.1.0 released Spring Boot 4.1.0 reached general availability on 2026-06-10. New features include first-class gRPC server and client support with standalone Netty and HTTP/2 servlet options, auto-configuration of Jackson read and write features through spring.jackson.read. and spring.jackson.write. properties, expanded OpenTelemetry configuration (SDK disable toggle, batch log processor, sampler, span and log limits, OTLP exemplars), and SSRF mitigation via an InetAddressFilter for both reactive and blocking HTTP clients. The release deprecates Derby database support, removes the deprecated layertools jar mode, and changes Maven so -DskipTests no longer skips AOT processing (use maven.test.skip). It bundles Spring Framework 7.0.8, Spring Security 7.1.0, Netty 4.2.15, Tomcat 11.0.22, and Hibernate 7.4.1.
  2. Languages confirmed WASI 0.3 ratified with first-class async The WASI Subgroup ratified WASI 0.3.0 on 2026-06-11. The release moves async into the WebAssembly Component Model canonical ABI, making stream<T> and future<T> first-class constructs and replacing the WASI 0.2 pollable and resource-based stream patterns. The model shifts from readiness-based to completion-based async, with the host managing one shared event loop for all components instead of each component carrying its own. wasi:http is reorganized into service and middleware worlds, enabling component-to-component service chaining without network calls. Wasmtime 45 supports the release candidate; Wasmtime 46 will ship WASI 0.3.0 with async enabled by default. The jco JavaScript toolchain supports it, and guest toolchain support for Rust, Go, JavaScript, Python, and C is in progress.

Apple platforms

  1. Apple confirmed Apple migrates the TrueType hinting interpreter from C to Swift Apple rewrote the TrueType hinting interpreter from C to memory-safe Swift and shipped it in the fall 2025 releases. The post states the Swift interpreter runs about 13 percent faster than the C code it replaced. Font parsers process untrusted input, making the hinting interpreter a security-critical attack surface that motivated the migration.

Infrastructure

  1. Infrastructure discussion Looking forward to PostgreSQL 19 A widely read write-up covers PostgreSQL 19 bringing application-time temporal table support, the half of the SQL:2011 bi-temporal model that Postgres had not yet implemented. PostgreSQL 19 Beta 1 shipped 2026-06-04 and also adds parallel autovacuum, INSERT ... ON CONFLICT DO SELECT, SQL/PGQ graph queries, and REPACK, with JIT disabled by default.

Engineering posts

  1. Engineering post discussion Reducing the sloppiness of AI-generated front-end code A practitioner post describes concrete steps to reduce low-quality output from AI front-end generation, covering design constraints, component reuse, and review checkpoints. HN discussion debated how much of the improvement comes from prompting versus tighter design systems and linting.

Markets and companies

  1. Markets confirmed SpaceX MSCI early index inclusion effective 2026-06-13 SpaceX (NASDAQ: SPCX), which began trading 2026-06-12 at $135 per share after a $75 billion raise at a $1.75 trillion valuation, becomes eligible for early MSCI index inclusion effective 2026-06-13. S&P 500 fast-track entry remains blocked by the index committee over the dual-class share structure.

Hacker News

  1. Pulse discussion If you are asking for human attention, demonstrate human effort A high-discussion front-page essay (1554 points) argues that low-effort, AI-generated requests for human time should be deprioritized. HN discussion connected it to maintainer burden from AI-generated bug reports and pull requests, echoing the FFmpeg AI-disclosure thread.
  2. Pulse discussion Open source AI must win An opinion piece arguing for open-weight AI drew 661 points the same day as the Fable 5 and Mythos 5 suspension. Commenters debated funding models for open-weight training, what "open source" means for hosted models, and whether open weights insulate users from government access controls; several noted the best open weights are roughly at Sonnet level.