2026-07-07
Top stories
- KVM guest-to-host escape CVE-2026-53359 (Januscape) goes public A use-after-free in KVM/x86 shadow MMU allows guest kernel code to escape to the host on both Intel and AMD systems.
- OpenSSH 10.4 ships post-quantum signatures and several transport fixes OpenSSH 10.4 fixes transport and sftp security issues and adds experimental post-quantum signatures combining ML-DSA 44 with Ed25519.
- Anthropic reports a global workspace in language models Anthropic's J-space research describes internal representations that the model can report on, deliberately activate, and causally edit in tests.
- GLM 5.2 pricing fuels an AI inference-margin debate Martin Alderson argues that GLM 5.2 at 4.40 per million tokens threatens frontier-lab inference margins compared to 25 dollar estimates for Opus.
- Kani model checker verifies Rust at industrial scale Kani, an open-source model checker for Rust, compiles verification harnesses into CBMC and runs 16,000 checks per change in the standard library.
Conferences and events
AI
- Fable rebuilds a reMarkable tablet as a Harry Potter diary A project uses Claude Fable to turn a reMarkable tablet into a conversational notebook, framed as Tom Riddle's Harry Potter diary.
- Ternlight ships a 7 MB embedding model that runs in the browser Ternlight is a seven-megabyte text-embedding model that runs client-side in the browser via WebAssembly for on-device semantic search.
ML research
Agentic coding
Security
- Bad Epoll CVE-2026-46242 gives root from the Linux epoll subsystem Bad Epoll is a race-condition use-after-free in the Linux kernel epoll subsystem that enables local privilege escalation exploitable from Chrome.
- Langflow flow-access IDOR CVE-2026-55255 added to CISA KEV Langflow CVE-2026-55255 is an IDOR allowing authenticated users to execute flows belonging to other users, added to CISA's known exploited list.
- Reverse engineering documents a Microsoft global device ID A reverse-engineering write-up documents Microsoft's device ID stored in the registry and linked to Microsoft Account registrations.
Languages and runtimes
Linux and kernel
Engineering posts
- Why low-latency Java still requires discipline A Chronicle Software post argues that low-latency Java still requires allocation discipline despite recent garbage-collector advances.
- One Postgres instead of separate systems A resource site collects the case for consolidating queue, cache, search, and vector systems onto a single Postgres database.
Markets and companies
- Better Auth joins Vercel Better Auth, the framework-agnostic open-source authentication library, joined Vercel to refocus on the framework without monetization pressure.
- Amazon closes Mechanical Turk to new customers Amazon is closing Mechanical Turk to new customers, ending an onboarding path for teams that relied on it for dataset and evaluation work.