2026-07-18
Top stories
- wp2shell pre-authentication RCE in WordPress Core Searchlight Cyber disclosed wp2shell, an unauthenticated remote code execution chain in WordPress core that requires no plugins or account.
- AWS Cost Explorer inflated billing estimates corrected AWS Cost Explorer showed falsely inflated billing estimates ranging to trillions due to a unit-pricing defect that was corrected by July 18.
- Mozilla publishes its first State of Open Source AI report Mozilla reported the gap between open and proprietary models has narrowed to 3 percent with inference costs down 50x over three years.
Conferences and events
AI
- Kimi K3 tops the Frontend Code Arena after launch Following the July 16 launch, Kimi K3 reached first place in Arena.ai's Frontend Code Arena at 1679 points ahead of Claude Fable 5.
- GPT-5.6 reportedly closes a derivative-free convex optimization gap GPT-5.6, given a specialized prompt, produced a Lean-verified proof closing a long-open gap in derivative-free convex optimization.
Agentic coding
Security
- TP-Link Kasa cameras expose credentials and location on the local network TP-Link Kasa cameras expose hardcoded decryption keys and GPS coordinates via unauthenticated local discovery without firmware updates.
- LG monitors auto-install system software through Windows Update LG monitors trigger Windows Update to install an LG application with broad access that displays McAfee ads without user consent.
Engineering posts
- Field notes on operating SQLite in production Julia Evans published field notes on running SQLite for a small production service, covering backup strategy, credentials, and query planning.
- Abusing progressive JPEG scans to embed animations in one file Maurycy published how to embed animations in a single JPEG file by exploiting progressive JPEG multi-scan rendering up to 90 frames.