2026-08-01
Top stories
- Microsoft attributes the CaptiveCrunch captive-portal campaign to a Midnight Blizzard sub-cluster Microsoft attributes a captive-portal campaign running since May 2026 to Midnight Blizzard, delivering Windows and Android malware.
- Broadcom advisory VMSA-2026-0006 patches unauthenticated vCenter authentication bypass and remote code execution at CVSS 9.8 and a VMXNET3 virtual machine escape at 9.3, with no workarounds VMSA-2026-0006 patches an unauthenticated vCenter authentication bypass at 9.8, remote code execution at 9.8, and a guest-to-host escape.
- Tailscale publishes its own account of how a stolen auth key enrolled 181 nodes in the Hugging Face intrusion Tailscale attributes the Hugging Face intrusion to a stolen CI key that enrolled 181 nodes, prescribing workload identity federation.
- The Go Collections working group proposes standard-library sets, hash maps, and ordered maps for Go 1.28 The Go Collections working group proposes standard-library sets, hash maps, and ordered maps as preview features for Go 1.28 availability.
- WASTE streams Kimi K3 from NVMe and decodes at 0.5 tokens per second on a 64 GB laptop WASTE streams Kimi K3 expert parameters from disk to run a frontier model on one 64 GB laptop with terabyte-scale NVMe storage.
AI
- The EU AI Act transparency obligations and Commission enforcement powers apply from 2026-08-02 The EU AI Act transparency obligations require machine-identifiable AI-generated content and labeled deep fakes effective 2026-08-02 globally.
- Artificial Analysis publishes an independent evaluation of DeepSeek V4 Flash 0731 Artificial Analysis measured DeepSeek V4 Flash at 0.027 USD per Intelligence Index task, the lowest cost of thirteen models evaluated.
- GitHub Copilot deprecates Gemini 2.5 Pro and Gemini 3 Flash across every Copilot surface GitHub Copilot deprecated Gemini 2.5 Pro and Gemini 3 Flash across every surface with no grace period or automatic replacement model.
ML research
Agentic coding
- Y Combinator publishes qm, an MIT-licensed multiplayer agent harness with per-scope sandboxes Y Combinator released qm, an MIT-licensed agent harness scoping memory, files, and credentials per person and room across multiple platforms.
- Simon Willison ships two clients and a server against the stateless MCP specification and publishes the request-level diff Simon Willison shipped MCP implementations showing stateless MCP removes server-side session state, simplifying load balancer deployments.
- Cursor removes per-request dollar cost from the usage page, the CSV export, and the dashboard API for self-serve and Teams plans, including historical records Cursor removed per-request and per-model dollar cost from self-serve and Teams usage reporting, retaining cost data only in the Admin API.
Security
- Rails publishes forensic tooling and the CVE-2026-66066 attack chain from a 37signals production sweep Rails published forensic tooling for CVE-2026-66066, showing how HDF5 external file lists let attackers read arbitrary files through libvips.
- Amazon attributes the debug, chalk, and axios npm compromises to one North Korean cluster and names slopsquatting on AI-hallucinated package names as a live technique Amazon attributes npm compromises to a North Korean operator using social engineering, maintenance windows, and AI-hallucinated package names.
- npm bypass-2FA granular access tokens lose account, organization, and package management, with direct publish going in January 2027 npm granular access tokens now require 2FA for account changes, token management, and package permission modifications starting immediately.
- CISA alerts the water sector to activity against internet-exposed PLCs after more than 30 Minnesota community water systems were disrupted CISA alerts water utilities to coordinated PLC attacks disrupting thirty Minnesota community systems, with over four thousand devices exposed.
Developer tools
- Servo 0.4.0 lands 558 commits, SpiderMonkey security updates, and a fix for XSS in file:/// directory listings Servo 0.4.0 adds 558 commits, SpiderMonkey security updates, XSS fixes in file URLs, and a C API for embedding Servo as an engine.
- An open ripgrep issue reports the official musl binaries segfaulting inside musl's mallocng during very large concurrent searches ripgrep 15.2.0 musl binaries segfault on large concurrent directory traversals through an integrity assertion in musl's memory allocator.
Languages and runtimes
Linux and kernel
- LWN reports gccrs spent the first half of 2026 on kernel crates and fixed a Drop bug that left locks held LWN reports gccrs spent 2026's first half on kernel crates, fixing Drop and name-resolution bugs while testing Rust for Linux compilation.
- A long-time Arch Linux developer resigns and leaves mkinitcpio and arch-install-scripts without an active maintainer A long-time Arch Linux developer resigned, leaving mkinitcpio, arch-install-scripts, and the package-signing keyring without active maintainers.
Infrastructure
- ClickHouse measures strict memory overcommit turning a Postgres instance-wide OOM restart into one failed query at no measurable throughput cost ClickHouse shows strict memory overcommit converts a Postgres instance-wide OOM restart into a single failed query with no throughput impact.
- Cloudflare adds a provisioning API for isolated Media over QUIC relays with separate publisher and subscriber tokens Cloudflare added a provisioning API for isolated MoQ relays with per-relay tokens that carry expiry and revocation, replacing shared endpoints.
Engineering posts
- Manifest describes why it deprecated the LLM router it ran for four months across 7000 users Manifest deprecated its LLM router after finding prompt text does not carry task complexity revealed by tool calls and prefix cache is cheaper.
- A DataFusion graph engine computes connected components on a two billion edge graph under a hard 10 GB limit A DataFusion graph engine computes connected components on a two-billion-edge graph within a hard 10 GB memory limit using disk offloading.