2026-08-02
Top stories
- Coldcard ships an urgent hotfix after a build flag disabled the hardware random number generator, leaving seeds with as little as 40 bits of entropy Coldcard firmware 4.0.1 through 4.1.9 reduced Mk3 seed entropy from 128 bits to 40 bits due to a build flag disabling hardware RNG.
- A ripgrep segfault investigation localizes a Linux kernel TLB-shootdown race between the per-VMA-lock anonymous fault path and concurrent munmap A Linux kernel race in the v7.0 anonymous page fault path and munmap can silently lose stores from multithreaded processes.
- Lean publishes a postmortem for kernel soundness bug 14576 after an AI-assisted false disproof of Collatz passed both the official kernel and a then-week-old version of the main external checker A Lean kernel soundness bug required two distinct bugs in Lean and the external checker nanoda for an AI-assisted false disproof to pass.
- OpenAI publishes ten claimed advances in mathematics and theoretical computer science with Lean 4 certificates under Apache-2.0 OpenAI released ten formalizations in Lean 4 of mathematics and computer science results without peer review under Apache-2.0.
AI
- Wafer measures Kimi K3 at 952 tokens per second per node on eight MI355X after fixing a missing ROCm top-k renorm and an AITER prefill head-count mismatch Framework defects in Kimi K3's ROCm build left the speculative decoder and MLA prefill broken, fixed with small source-level changes.
- ByteDance releases Seedance 2.5 without published weights ByteDance released Seedance 2.5 video generation model without weights or stated training and evaluation methods.
ML research
Security
- Unit 42 reports XCSSET v40 spreading through the Xcode projects of legitimate apps since April 2026, with fileless persistence and suppression of macOS security updates XCSSET v40 spreading since April 2026 disables macOS security updates and adds fileless persistence through Chrome and Telegram trojans.
- A scan of 7.6 petabytes of public Hugging Face datasets finds 221,303 live credentials, including 349 live GitHub personal access tokens A scan of 7.6 petabytes of public Hugging Face datasets found 221,303 live credentials including 349 GitHub personal access tokens.
- RFC 10015 makes finite-field Diffie-Hellman and RSA key exchange MUST NOT in TLS 1.2 and DTLS 1.2 RFC 10015 published in July 2026 makes finite-field Diffie-Hellman and RSA key exchange disallowed in TLS 1.2 and DTLS 1.2.
- A USENIX Security paper shows the major end-to-end encrypted messengers give no transcript consistency in group chats A USENIX Security paper finds no major end-to-end encrypted messenger provides transcript consistency against malicious group members.
Languages and runtimes
- Go 1.27 draft release notes describe generic methods, encoding/json/v2 backing encoding/json, and a post-quantum crypto/mldsa package Go 1.27 draft notes describe generic methods, encoding/json/v2 backing encoding/json, and a new post-quantum crypto/mldsa package.
- The Rust All Hands 2026 retrospective records settled reference and union validity, renewed momentum to stabilize Allocator, and a rustdoc JSON path for cargo-semver-checks The Rust All Hands retrospective records settled reference and union validity semantics and renewed momentum to stabilize Allocator trait.
- Solid Queue 1.6.0 adds fiber-based workers Solid Queue 1.6.0 adds fiber-based worker mode to the default Rails background job system, changing concurrency and memory profiles.